67419 matches found
CVE-2026-92424
The Content Egg WordPress plugin (versions prior to 11.9.0 ) is vulnerable to a stored Cross-Site Scripting (XSS) flaw. The issue arises because the bulk content-import feature fails to verify if a user is authorized to use a selected import preset; instead, it switches to the preset author's ide...
EUVD-2026-89621
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...
CVE-2026-92424 Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...
WordPress Content Egg plugin < 11.9.0 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by aymen benlamari in WordPress Plugin Content Egg versions 11.9.0...
EUVD-2026-89631
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...
CVE-2026-80333 Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...
CLEANSTART-2026-MY04156 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute
Security vulnerability affects the minio-operator package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...
CLEANSTART-2026-YO89791 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
Security vulnerability affects the minio-operator package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CLEANSTART-2026-TO10251 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Security vulnerability affects the minio-operator package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...
PT-2026-103528
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.1 Description Content Injection occurs due to insufficient validation of a URL parameter in the PDF viewer. This flaw allows an attacker-controlled document to be loaded and displayed under the trust of the...
PT-2026-103042
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...
AlmaLinux 9.2 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.2:CLSA-2026:1787754280)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787754280 advisory. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusab...
CVE-2026-92424: Improper Neutralization of Input During Web Page Generation
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...
Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1782908606)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782908606 advisory. - When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker ...
AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752087722)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752087722 advisory. - The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS...
CVE-2026-102090: URL Redirection to Untrusted Site
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...
CVE-2026-102137: Unrestricted Upload of File with Dangerous Type
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...
PT-2026-103007
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post content Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...