CVE-2026-4086 WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wprandombutton' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on...

CVE-2026-4086

The CVE concerns the WP Random Button WordPress plugin (versions up to 1.0). It is vulnerable to Stored Cross-Site Scripting via the wp_random_button shortcode attributes cat, nocat, and text. The root cause is insufficient input sanitization and output escaping: the random_button_html() function...

PT-2026-26875

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp random button' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on...

PT-2026-26907

jetAudio 8.1.7 contains a buffer overflow vulnerability in the video converter component that allows local attackers to crash the application by supplying an oversized string in the File Naming field. Attackers can paste a malicious buffer of 512 bytes into the File Naming parameter and trigger t...

CVE-2026-33209

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting XSS vulnerability exists in the returnto query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is execute...

EUVD-2026-13072

The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the...

CVE-2026-4120

The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the...

MAL-2026-1818 Malicious code in player-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ef576512d757081a6ffcf3225a09220078dde23b0825b516ee210f6bf1b0c94 The package player-button was found to contain malicious code...

Malicious code in player-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ef576512d757081a6ffcf3225a09220078dde23b0825b516ee210f6bf1b0c94 The package player-button was found to contain malicious code...

Malicious code in @kui-react/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb2774da41feb2f5825c18cb59ff37b64a456fd5770d202cc5542aaaa634f4df The package @kui-react/button was found to contain malicious code...

MAL-2026-1625 Malicious code in @kui-react/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb2774da41feb2f5825c18cb59ff37b64a456fd5770d202cc5542aaaa634f4df The package @kui-react/button was found to contain malicious code...

Malicious code in @emerald-react/icon-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a17ff250c076101691329fe30e2efab7630e3563d3c0e6423a94d0eeec60d3dc The package @emerald-react/icon-button was found to contain malicious code...

MAL-2026-1611 Malicious code in @emerald-react/icon-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a17ff250c076101691329fe30e2efab7630e3563d3c0e6423a94d0eeec60d3dc The package @emerald-react/icon-button was found to contain malicious code...

Malicious code in @emerald-react/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a53b07341310aa38bec5a12c64977afb8a97b940baf599f6e8d632417b9997e The package @emerald-react/button was found to contain malicious code...

MAL-2026-1601 Malicious code in @emerald-react/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a53b07341310aa38bec5a12c64977afb8a97b940baf599f6e8d632417b9997e The package @emerald-react/button was found to contain malicious code...

EUVD-2026-12383

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that return...

Mattermost fails to limit the size of responses from integration action endpoints

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that return...

CVE-2026-2456

Mattermost is affected by CVE-2026-2456 due to an unbounded memory allocation when handling responses from integration action endpoints. A authenticated attacker can cause server memory exhaustion and a denial of service by having a malicious integration server return an arbitrarily large respons...

CVE-2026-2456

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that return...

CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that return...