PT-2026-104177

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via comment content. This...

PT-2026-104379

Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.0 through 15.5.26 Next.js versions 16.x through 16.3.7 Description Self-hosted applications using the Pages Router with statically generated pages or Incremental Static Regeneration ISR can key a response cache entry...

CVE-2026-94543: Use of Cache Containing Sensitive Information

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

PT-2026-104225

Name of the Vulnerable Software and Affected Versions Ghost versions 2.5.0 through 6.63.0 Description A stored cross-site scripting issue exists where untrusted scripts can be injected into post content through oEmbed photo responses. An attacker can host a malicious oEmbed photo response; when t...

PT-2026-104153

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search versions prior to 4.28.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. This enables the injection of...

PT-2026-104142

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-104145

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-104376

Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.0 through 15.5.26 Next.js versions prior to 16.3.8 Description Applications using a root-level catch-all page and statically generated or Incremental Static Regeneration ISR routes use a shared response cache key that is...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790962865)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790962865 advisory. - In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are...

CVE-2026-97641: Improper Neutralization of Input During Web Page Generation

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-104414: Improper Neutralization of Input During Web Page Generation

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost...

PT-2026-104361

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-96578: Improper Neutralization of Input During Web Page Generation

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-95817: Improper Neutralization of Input During Web Page Generation

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Linux Distros Unpatched Vulnerability : CVE-2026-94484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and...

UBUNTU-CVE-2026-73856

GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical Content-Type casing...

Linux Distros Unpatched Vulnerability : CVE-2026-94543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router wit...

ketello: Katello Content View History API Cross-Organization Authorization Bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

ketello: Katello Content View History API Cross-Organization Authorization Bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

ketello: Katello Content View History API Cross-Organization Authorization Bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...