1148568 matches found
Important: Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by LevinityCyber in WordPress Plugin Bold Page Builder versions = 5.9.9...
WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Simple Payment versions = 2.5.4...
WordPress AI Builder plugin 2.4.1-2.7.7 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin AI Builder versions 2.4.1-2.7.7...
EUVD-2026-75969
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...
Security-labs
Security Labs — Complete Portfolio Student: Waseem Env...
SUSE CVE-2026-19872
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
PT-2026-90025
Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...
CVE-2026-86780: Improper Neutralization of Input During Web Page Generation
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...
MiracleLinux 9 : opentelemetry-collector-0.152.1-2.el9_8 (AXSA:2026-1812:05)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1812:05 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service...
RHEL 10 : grafana-pcp (RHSA-2026:66459)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:66459 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...
CVE-2026-62111: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...
WordPress WP-Stats 2.5.6 Cross Site Scripting
WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...
PT-2026-90026
Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...
PT-2026-90036
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...
PT-2026-90055
Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. Th...
CVE-2026-77490: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...