webscan

webscan webscan is a browser-based network IP scanner and local IP detector. It detects IPs bound to the user/victim by listening on an RTP data channel via WebRTC and looping back to the port across any live IPs, as well as discovering all live IP addresses on valid subnets by monitoring for...

CVE-2026-89240

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

CVE-2026-89240 WWBN AVideo Reflected XSS via confirmLivePassword.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

img-payloads

⚠️ Disclaimer : The content in this repository is for educational and informational purposes only; the authors hold no responsibility for misuse. Ensure proper authorization before use, act responsibly at your own risk, and comply with all legal and ethical guidelines. 🚀...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 security and bug fix advisory

Updated packages that resolve various issues are now available for Red Hat OpenStack Platform 17.1 Wallaby for Red Hat Enterprise Linux RHEL 9.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw...

RHEL 9 : Red Hat OpenStack Platform 17.1 security advisory (Important) (RHSA-2026:66401)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66401 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-86771

Snipe-IT versions before 8.7.0 are vulnerable to Server-Side Request Forgery (SSRF) through the employee_num field in the asset acceptance PDF generator. The root cause is a failure to HTML-escape this field before passing it to TCPDF's writeHTML() function, allowing an attacker with the users.ed...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-87812

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

Malicious code in google-img-scrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86caa3dfd7fbfa99dfa8042e4792f31346c57427e7eb83cbc468b5a14d4c0e14 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-77263

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via comment content in all versions up to and including 3.13.4 . The root cause is insufficient input sanitization and output escaping: an attacke...

EUVD-2026-60440

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close...

PT-2026-84883

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui agents/s1/utils/ocr server.py of the component OCR HTTP API. Executing a manipulation of the argument img bytes can lead to resource consumption. The attack m...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

EUVD-2026-67407

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-3129

The LiteSpeed Cache plugin for WordPress (all versions up to and including 7.7 ) is vulnerable to Stored Cross-Site Scripting via crafted tag attributes. The root cause is a flawed regular expression used to strip width and height attributes from images when the "Lazy Load Images" and "Add Missi...

WordPress LiteSpeed Cache plugin <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes vulnerability

Authenticated Author+ Stored Cross-Site Scripting via img Tag Attributes vulnerability discovered by stealthcopter in WordPress Plugin LiteSpeed Cache versions = 7.7...