jotty.page < 1.22.0 - Path Traversal

jotty·page 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/filename, letting unauthenticated attackers read arbitrary files outside intended directory. id: CVE-2026-42564 info: name: jotty.page 1.22.0 - Path Traversal author: Het-Kalariya...

Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting

The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'planicons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting

The Easy Social Icons plugin = 3.0.8 for WordPress echoes out the raw value of $SERVER'PHPSELF' in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path...

Malware in @fmr-ap153177/apex-kit-icons

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-123856

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server...

CVE-2026-123856

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server...

EUVD-2026-118316

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server...

CVE-2026-123856

The JetBrains Toolbox App versions before 3.6.1 are vulnerable to NTLM hash disclosure . This issue occurs when the application processes SVG tool icons from a Remote Development server . There are no specific details provided regarding the root cause or remediation, and no exploit information is...

CVE-2026-123856: JetBrains Toolbox App: In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development…

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server...

CVE-2026-105259

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons...

CVE-2025-15701

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is...

CVE-2026-105259

The Easy Social Icons WordPress plugin (versions before 4.0.3 ) is vulnerable to Stored XSS because it fails to properly sanitise SVG files added to the site-wide upload list. This allows users with the Author role or higher to upload a malicious SVG containing XSS payloads. If another version of...

EUVD-2026-117350

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons...

WordPress Easy Social Icons plugin < 4.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by aschoiloa1890 in WordPress Plugin Easy Social Icons versions 4.0.3...

CVE-2026-105259 Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons...

CVE-2025-15701

The Easy Social Icons WordPress plugin (versions before 4.0.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to sanitize and escape certain settings before outputting them on front-end pages. This flaw specifically affects high-privilege users , such as Administrators, and ...

WordPress Easy Social Icons plugin < 4.0.3 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Easy Social Icons versions 4.0.3...

EUVD-2025-211266

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is...

CVE-2025-15701 Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is...

CVE-2026-121588

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...