PT-2026-3160

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.13.0 Description WebsiteBaker version 2.13.0 has a flaw that permits authenticated users with language editing rights to execute code remotely. This is possible through manipulation of parameters within the language...

PT-2026-2987

Name of the Vulnerable Software and Affected Versions Grafana XY Chart Plugin affected versions not specified Description The XY Chart plugin has a DOM XSS issue. A user with Editor permissions can modify a panel to execute arbitrary JavaScript. Recommendations At the moment, there is no...

PT-2026-2986

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A security issue exists in the /apis/dashboard.grafana.app/ API endpoints, allowing authenticated users to bypass dashboard and folder permissions. This affects all API versions v0alpha1,...

CVE-2025-71164 Typesetter CMS Reflected XSS via Editing.php

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting XSS vulnerability in the Editing component. The images parameter submitted as images in a POST request is reflected into an HTML href attribute without proper context-aware output encoding in...

CVE-2025-71164 Typesetter CMS Reflected XSS via Editing.php

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting XSS vulnerability in the Editing component. The images parameter submitted as images in a POST request is reflected into an HTML href attribute without proper context-aware output encoding in...

Improper Access Control

n8n is vulnerable to Improper Access Control. The vulnerability is due to insufficient isolation in the legacy JavaScript execution mode of the Code node, which allows an authenticated attacker with workflow editing privileges to invoke internal helper functions and read or write arbitrary files ...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

EUVD-2026-0940

Malicious code in spire.officejs-editors npm...

MAL-2026-40 Malicious code in spire.officejs-editors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a16e661181ec9b4834133423f88991671288814200d66aa148195cc9c06b5aff The package spire.officejs-editors was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in spire.officejs-editors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a16e661181ec9b4834133423f88991671288814200d66aa148195cc9c06b5aff The package spire.officejs-editors was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-13592

CVE-2025-13592 affects the WordPress plugin Advanced Ads (

Cross-site Scripting (XSS)

ibexa/admin-ui is vulnerable to cross-site scripting XSS. The vulnerability is due to improper escaping of user-controlled input in image asset names, content language names, and future publishing within the back office, which allows an attacker with editor or administrator-level permissions to...

WordPress plugin Advanced Ads 代码注入漏洞

WordPress Advanced Ads is an ad management plugin for WordPress designed to help website owners manage, optimize, and monetize their websites efficiently. WordPress Advanced Ads suffers from a code execution vulnerability that arises due to insufficient validation of user input by the...

CVE-2025-68697 Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...

CVE-2025-68697 Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...

CVE-2025-68697 Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...

Exposed Dangerous Method or Function

Overview Affected versions of this package are vulnerable to Exposed Dangerous Method or Function in the Code node when running in legacy JavaScript execution mode. An attacker can access or modify files on the host system with the same privileges as the application process by invoking internal...

GHSA-J4P8-H8MH-RH8Q Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

Impact In self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with...

PT-2025-53606

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.0.0 Description n8n is a workflow automation platform. In self-hosted instances before version 2.0.0, when the Code node operates in legacy JavaScript execution mode, authenticated users with workflow editing permission...

EUVD-2025-204369

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses...