RHEL 9 : image-builder (RHSA-2026:1377)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:1377 advisory. A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang:...

RHEL 10 : osbuild-composer (RHSA-2026:1378)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1378 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...

@saltcorn/cli (>=1.1.1 <=1.4.1-beta.3), @saltcorn/mobile-builder (>=1.1.1 <=1.4.1-beta.3) +1 more potentially affected by unknown CVE via @saltcorn/admin-models (>=1.1.1 <=1.4.1)

@saltcorn/admin-models NPM version =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.4.1-beta.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNADMINMODELS-15126138...

@saltcorn/cli (>=1.5.0-beta.0 <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.5.0-beta.0 <=1.5.0-beta.18) +1 more potentially affected by unknown CVE via @saltcorn/admin-models (>=1.5.0-beta.0 <=1.5.0-beta.18)

@saltcorn/admin-models NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNADMINMODELS-15126138...

@saltcorn/cli (>=1.1.1 <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.1.1 <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1 <=1.5.0-beta.18)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: OSV:GHSA-CR3W-CW5W-H3FJ...

@saltcorn/cli (>=1.1.1 <=1.4.1-beta.3), @saltcorn/mobile-builder (>=1.1.1 <=1.4.1-beta.3) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1 <=1.4.1)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.4.1-beta.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

@saltcorn/cli (>=1.5.0-beta.0 <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.5.0-beta.0 <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0 <=1.5.0-beta.18)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

CVE-2026-24594

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through = 3.9.4...

CVE-2026-24620

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginOps Landing Page Builder page-builder-add allows Stored XSS.This issue affects Landing Page Builder: from n/a through = 1.5.3.4...

CVE-2025-13139

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing nonce validation on the SurveyJSAddSurvey AJAX action. This makes it possible for unauthenticated attackers to crea...

CVE-2025-13205

CVE-2025-13205 affects the SurveyJS: Drag & Drop Form Builder for WordPress, versions up to and including 1.12.20. The root cause is missing or incorrect nonce validation on the SurveyJS_CloneSurvey AJAX action, enabling CSRF. Impact: unauthenticated attackers could duplicate surveys by tricking ...

CVE-2025-13205

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing or incorrect nonce validation on the...

CVE-2025-13194

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce verification on the 'SurveyJSRenameSurvey' AJAX...

CVE-2025-13139

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJSAddSurvey AJAX action. This makes it possible for unauthenticated attackers to...

CVE-2025-67230

Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation...

CVE-2025-67231

A reflected cross-site scripting XSS vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload...

CVE-2025-67229

An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation...

WordPress plugin SurveyJS: Drag & Drop WordPress Form Builder – Cross-site Request Forgery Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

PT-2026-4600

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce verification on the 'SurveyJS RenameSurvey' AJA...

CVE-2025-69319

Improper Control of Generation of Code 'Code Injection' vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This issue affects Beaver Builder: from n/a through = 2.9.4.1...