8362 matches found
CVE-2026-14855: Improper Neutralization of Input During Web Page Generation
The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...
PT-2026-95309
Name of the Vulnerable Software and Affected Versions CSS & JavaScript Toolbox versions prior to 12.0.7 Description The plugin is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. The issue exists within the Assignment Engine...
PT-2026-95222
Name of the Vulnerable Software and Affected Versions RT Mega Menu versions prior to 1.5.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting...
PT-2026-95710
Name of the Vulnerable Software and Affected Versions Open edX Platform versions Redwood through Ulmo and Verawood.1 Description The add additional attributes to notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing...
WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC
Description WordPress does not properly enforce the capability required to edit custom CSS when publishing customizer changes through XML-RPC in some cases, which could allow site administrators on Multisite, who are denied that capability, to inject arbitrary CSS into the site...
WordPress Core <= 7.1 - Author+ Custom CSS Capability Bypass via XML-RPC vulnerability
Author+ Custom CSS Capability Bypass via XML-RPC vulnerability discovered by Ben Bidner in WordPress core versions = 7.1...
CVE-2026-68537
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
CVE-2026-68523
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
Malicious code in lint-xo-ceres-mini-css-extract-plugin (npm)
Source: amazon-inspector daa7e2a9508eacc4043acfb139a17de0eaa316004f37d0113aea6b9de678ee44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lint-perseus-css-minimizer-webpack-plugin-cygnus (npm)
The package lint-perseus-css-minimizer-webpack-plugin-cygnus was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in lint-staged-dactyl-optimize-css-assets-webpack-plugin-less (npm)
Source: amazon-inspector 90fedf4b2f7d5f9c62ab838cb326ef31ed83b2bf95b02afbcdea9f615c976407 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in link-gravity-css-loader-arcturus (npm)
Source: amazon-inspector a75f70a93f2d197cb9e483e0fb1bcad8f2a0bcddcb8ff63508f3e3bd5dd087ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in library-pulsar-mini-css-extract-plugin-init (npm)
Source: amazon-inspector eff0fb1b97ee68f4cc8f0b9b98ba61800524ef8ebc7b178ab015f3513bcd079d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in levels-optimize-css-assets-webpack-plugin-hermes-callisto (npm)
The package levels-optimize-css-assets-webpack-plugin-hermes-callisto was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in less-optimize-css-assets-webpack-plugin-miranda-algol (npm)
Source: amazon-inspector 0aaa871e18d8615f0e0c18e15bf0a02a74ef0928a0fc68986a09fc66ad5202a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
EUVD-2026-82432
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
CVE-2026-68523 Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
CVE-2026-68523 Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
CVE-2026-68523
"fulgur" converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
CVE-2026-68523 Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...