WordPress Vigilant plugin <= 2.10.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sebastian Albrecht in WordPress Plugin Vigilant versions = 2.10.2...

WordPress Simple Ajax Chat plugin <= 20260811 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HEI LAI SZE in WordPress Plugin Simple Ajax Chat versions = 20260811...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LevinityCyber in WordPress Plugin Bold Page Builder versions = 5.9.9...

WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Simple Payment versions = 2.5.4...

EUVD-2026-75969

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

WordPress AI Builder plugin 2.4.1-2.7.7 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin AI Builder versions 2.4.1-2.7.7...

Openemr < 7.0.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1. id: CVE-2022-2733 info: name: Openemr 7.0.0.1 - Cross-Site Scripting author: ctflearner severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to...

Microsoft Edge (Chromium) < 151.0.4129.107 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.107. It is, therefore, affected by multiple vulnerabilities as referenced in the September 11, 2026 advisory. - Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft...

RockyLinux 10 : osbuild-composer (RLSA-2026:66432)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:66432 advisory. golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821...

RHEL 10 : osbuild-composer (RHSA-2026:66432)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66432 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

MiracleLinux 9 : opentelemetry-collector-0.152.1-2.el9_8 (AXSA:2026-1812:05)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1812:05 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service...

Skype for Business (September 2026)

The Microsoft Skype for Business installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. CVE-2026-66302 -...

WordPress WP-Stats 2.5.6 Cross Site Scripting

WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...

RHEL 10 : grafana-pcp (RHSA-2026:66459)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:66459 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...