PT-2026-103504

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

PT-2026-103213

Contributor Cross Site Scripting XSS in The Plus Addons for Elementor Page Builder Lite = 6.5.1 versions...

PT-2026-103249

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...

PT-2026-103187

Subscriber Cross Site Scripting XSS in Profile Builder = 4.0.2 versions...

PT-2026-103088

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker can provide an improperly validated audience class name to the Report Builder component, leading to arbitrary class instantiation. This allows the unauthorized creati...

Kibana 9.4.x < 9.4.7 Privilege Escalation (ESA-2026-85)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.7. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-85 advisory. - Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A...

PT-2026-103058

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background image' parameter of the plugin's bt bb section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1777541348)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777541348 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate th...

PT-2026-103215

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-6173: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backgroundimage' parameter of the plugin's btbbsection shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

CVE-2026-6170: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's btbbcssimagegrid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This...

PT-2026-103060

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the bt bb service shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Fedora 44 : flatpak-builder (2026-9b73fdb8e6)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9b73fdb8e6 advisory. Update to 1.4.12 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1789577977)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789577977 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to...

CVE-2026-102580: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

MAL-2026-17282 Malicious code in @hrmony/hyper-json-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8139053048172994cadd0251ef74e5104c489dcb4f0448153ea9342b3feb707 On module load, index.js performs top-level fetch to a hardcoded attacker-controlled endpoint at...