Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, and Apple visionOS versions pri...

WordPress Royal Addons for Elementor cross-site scripting vulnerability

WordPress Royal Addons for Elementor versions 1.7.1069 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to DOM-based cross-site scripting attacks...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, and Apple tvOS versions prior t...

WordPress Gallery PhotoBlocks cross-site scripting vulnerability

WordPress Gallery PhotoBlocks versions 1.3.7 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

WordPress Advanced Post Block cross-site scripting vulnerability

WordPress Advanced Post Block versions 2.5.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to stored cross-site scripting attacks...

Cross-site scripting vulnerability in WordPress Better Post & Filter Widgets for Elementor

WordPress Better Post & Filter Widgets for Elementor versions 1.9.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation, potentially leading to stored cross-site scripting attacks...

PT-2026-123250

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

PT-2026-123440

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple macOS Tahoe versions prior to 26.7.2, Apple tvOS versions prior to 27, Apple visionOS versions prior to 27, and Apple watchOS versions prior to...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from improper input validation, leading to out-of-bounds writes; processing specially crafted...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iPadOS versions prior to 26.7.2, Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe...

WordPress Content Slider Block Cross-site Scripting Vulnerability

WordPress Content Slider Block versions 3.2.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

UBUNTU-CVE-2026-116013

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

WordPress Amelia cross-site scripting vulnerability

WordPress Amelia versions 2.4.12 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, and Apple macOS Golden Gate versions prior to 27.2. This vulnerability stems from improper input validation and may allow applications to access sensitive user data...

WordPress Image Gallery Block cross-site scripting vulnerability

WordPress Image Gallery Block versions 2.4.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

Crocoblock JetElements For Elementor cross-site scripting vulnerability

Crocoblock JetElements for Elementor versions 2.9.2.5 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation, potentially leading to stored cross-site scripting attacks...

CVE-2026-116181

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stoptokenids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or writ...

CVE-2026-116172

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass maxlogprobs limits via CandidateTokens.topn. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping topn values t...

EUVD-2026-109442

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stoptokenids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or writ...