PT-2026-84883

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui agents/s1/utils/ocr server.py of the component OCR HTTP API. Executing a manipulation of the argument img bytes can lead to resource consumption. The attack m...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

EUVD-2026-67407

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-3129

The LiteSpeed Cache plugin for WordPress (all versions up to and including 7.7 ) is vulnerable to Stored Cross-Site Scripting via crafted tag attributes. The root cause is a flawed regular expression used to strip width and height attributes from images when the "Lazy Load Images" and "Add Missi...

WordPress LiteSpeed Cache plugin <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes vulnerability

Authenticated Author+ Stored Cross-Site Scripting via img Tag Attributes vulnerability discovered by stealthcopter in WordPress Plugin LiteSpeed Cache versions = 7.7...

PT-2026-79831

Name of the Vulnerable Software and Affected Versions itsourcecode Payroll System version 1.0 Description An unrestricted file upload issue exists in the save settings function within the admin class.php file. A remote attacker can exploit this by manipulating the img argument to upload arbitrary...

CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

EUVD-2026-64262

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-76995

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. Th...

CVE-2026-76995 SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. Th...

CVE-2026-76995

The description states the exploit is publicly available but no exploit code or proof-of-concept is included in the provided documents, so actual exploitation status cannot be confirmed here.

CVE-2026-75981

TranslatePress ≤3.2.5 has an unauthenticated stored XSS in translate_page() (class-translation-render.php:538-539), where plain-text markers #!trpst#/#!trpen# survive wp_kses and are rewritten to , enabling execution in visitors' browsers; CVSS 7.2 HIGH. Exploitation in the wild is not reported ...

SUSE CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw...

CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

DEBIAN-CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

AZL-95613 CVE-2026-63623 affecting package libvirt for versions less than 11.9.0-1

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

UBUNTU-CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...