Skype for Business (September 2026)

The Microsoft Skype for Business installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. CVE-2026-66302 -...

WordPress WP-Stats 2.5.6 Cross Site Scripting

WordPress WP-Stats plugin versions 2.5.6 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231119...

CVE-2026-62111: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...

CVE-2026-89247: XML Injection (aka Blind XPath Injection)

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

CVE-2026-84960: Improper Neutralization of Input During Web Page Generation

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-78172: Improper Neutralization of Input During Web Page Generation

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-62139: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

PT-2026-90026

Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...

PT-2026-90036

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...

PT-2026-89850

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD Server/VMAP.php, which is reachable without authentication when the AD Server plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset...

Palo Alto Networks PAN-OS 10.0.x / 10.2.x / 11.0.x / 8.1.x / 9.0.x / 9.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 8.1.x, 9.0.x, 9.1.x, 10.0.x, 10.2.x, or 11.0.x. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious...

RHEL 10 : grafana-pcp (RHSA-2026:66459)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:66459 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

PT-2026-90054

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

PT-2026-90025

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

CVE-2026-18964: Improper Neutralization of Input During Web Page Generation

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and...

CVE-2026-19985: Improper Neutralization of Input During Web Page Generation

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray...

CVE-2026-18562: Improper Neutralization of Input During Web Page Generation

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wploadjs...

CVE-2026-62138: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...

CVE-2026-62110: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-88017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy drive...