CVE-2026-81737

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-16983

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

CVE-2026-81737

The FAQ Builder AYS WordPress plugin (versions 1.6.3-1.8.4 ) is vulnerable to Stored XSS because it fails to properly sanitize or escape content submitted by unauthenticated visitors . While some escaping is applied, it is bypassed by a subsequent decoding step before the data is displayed in an ...

CVE-2026-81737 FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-81737 FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-16983 Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

EUVD-2026-69866

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

CVE-2026-16983

The Gutentor WordPress plugin versions prior to 4.0.6 is vulnerable to sensitive information disclosure. The flaw exists because the plugin fails to apply proper context restrictions to one of its REST endpoints . This oversight allows any authenticated user with at least a Subscriber role to acc...

K000163170: Mbed TLS vulnerability CVE-2026-34877

Security Advisory Description An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary...

PT-2026-84841

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T CTX-typed base register as a silent no-op: do mem store in src/crab/ebpf transformer.cpp only models T STACK stores, and the...

PT-2026-84608

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

PT-2026-84638

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-73731

A reflected cross-site scripting (XSS) vulnerability in the web-based management interface of HPE Networking Fabric Composer allows an unauthenticated remote attacker to execute arbitrary script code in a victim's browser. The attack requires user interaction (e.g., clicking a crafted link) and r...

CVE-2026-80704

A flaw was found in the Linux kernel's drm/amd/display component. This vulnerability arises from the improper use of an uninitialized logging context, which can lead to a NULL pointer dereference. A local attacker could potentially trigger this flaw, causing the system to crash and resulting in a...

VulnCheck KEV: CVE-2023-39470

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists with...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

CVE-2026-14367

CVE-2026-14367 affects the Zephyr RTOS I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c. A statically-allocated work-node free-list (sys_slist_t) is accessed without synchronization: ISR-context callers invoke sys_slist_get() while the workqueue thread calls sys_slist_append(). This data race can...

CVE-2026-42588

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

Linux Distros Unpatched Vulnerability : CVE-2026-80699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW...

Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts

Large Language Models LLMs can solve complex problems, but their misuse in high-risk domains can lead to severe consequences. Model providers therefore restrict assistance for potentially harmful requests. Refusing all cybersecurity requests would therefore harm legitimate users. Providers need a...