CVE-2026-97262: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...

CVE-2026-96831: Deserialization of Untrusted Data

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96829: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in The Plus Addons for Elementor Page Builder Lite = 6.5.1 versions...

CVE-2026-96338: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Profile Builder = 4.0.2 versions...

PT-2026-103504

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

PT-2026-103213

Contributor Cross Site Scripting XSS in The Plus Addons for Elementor Page Builder Lite = 6.5.1 versions...

PT-2026-103249

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...

PT-2026-103187

Subscriber Cross Site Scripting XSS in Profile Builder = 4.0.2 versions...

CVE-2026-6172: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's btbbimage shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

PT-2026-103058

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background image' parameter of the plugin's bt bb section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2026-103088

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker can provide an improperly validated audience class name to the Report Builder component, leading to arbitrary class instantiation. This allows the unauthorized creati...

PT-2026-103215

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-102580: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

Fedora 44 : flatpak-builder (2026-9b73fdb8e6)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9b73fdb8e6 advisory. Update to 1.4.12 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2026-6173: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backgroundimage' parameter of the plugin's btbbsection shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1789577977)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789577977 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to...

Kibana 9.4.x < 9.4.7 Privilege Escalation (ESA-2026-85)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.7. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-85 advisory. - Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...

WordPress Bold Page Builder plugin <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucas torres Rooting in WordPress Plugin Bold Page Builder versions = 5.7.2...