CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96899

The Optima Express IDX WordPress plugin (versions 8.6.0 - 8.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly neutralise a script value submitted via a REST endpoint before storing it and subsequently echoing it into the document head ...

EUVD-2026-87901

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the download endpoint. An attacker can access restricted audio content by directly requesting media files using valid media identifiers. Remediation Upgrade azuracast/azuracast to version 0.23.8 or higher...

CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100853

AzuraCast versions prior to 0.23.8 are vulnerable to an authorization bypass in the public On-Demand download endpoint. The root cause is a failure to verify playlist-level access controls , which allows unauthenticated users to download media files that were intended to be excluded from On-Deman...

CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100879: Missing Authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

PT-2026-99473

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description The public On-Demand download endpoint fails to verify playlist-level access controls. This allows unauthenticated users to bypass intended access restrictions by directly requesting media via the...

CVE-2026-100882: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.labe...

PT-2026-99506

Name of the Vulnerable Software and Affected Versions Optima Express IDX WordPress plugin versions prior to 8.7.6 Description Stored Cross-Site Scripting occurs because the plugin fails to properly neutralize script values submitted through a REST endpoint. These values are stored and subsequentl...

PT-2026-99720

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6 Description Cross site scripting occurs in the Admin Settings Endpoint within the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php. A remote attacker can trigger this...

CVE-2026-100880: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It ...

PT-2026-99706

Name of the Vulnerable Software and Affected Versions zhistaredu StarTraining versions prior to 3.8.2 Description A weakness in the Upload Endpoint component, specifically within the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java, allows for remote cross-site scripting...

CVE-2026-100853: Missing Authorization

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100878: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds lea...

SUSE CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

Improper Check for Unusual or Exceptional Conditions

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the disaggregated serving endpoint /inference/v1/generate in...