CVE-2026-89417 OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-94220

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-89417 OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-89417

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.3.10 . The root cause is insufficient input sanitization and output escaping regarding the 's' Search Parameter within the comments...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

PT-2026-107432

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

WordPress Core 7.1.0-7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments (Comments administration screen) vulnerability

Unauthenticated Stored Cross-Site Scripting via Pending Comments Comments administration screen vulnerability discovered by Thomas Chauchefoin Trail of Bits in WordPress core versions 7.1-7.1.2...

CVE-2026-105059

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

EUVD-2026-93085

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

CVE-2026-105059 WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

CVE-2026-105059 WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

CVE-2026-105059

The Delete All Comments of wordpress plugin for WordPress versions

[SECURITY] Fedora 45 Update: ocaml-jsonm-1.0.2-16.fc45

Jsonm is an OCaml non-blocking streaming codec to decode and encode the JSON data format. It can process JSON text without blocking on IO and without a complete in-memory representation of the data. The uncut codec also processes whitespace and non-standard JSON with JavaScript comments...

PT-2026-106385

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

GHSA-HQR4-QQ8F-HG3X stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk vulnerability discovered by ? in WordPress Npm stream-json versions = 3.5.0...

CVE-2026-105684

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105681

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

EUVD-2026-92776

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...