CVE-2026-90438 Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-90438 Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2009-5120

Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate...

PT-2026-104079

Name of the Vulnerable Software and Affected Versions Autoptimize versions prior to 3.1.15.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-64422)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505983; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

PT-2026-104107

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

PT-2026-104397

MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off. However, the application stripped...

ROS-20261002-73-0137

The vulnerability in Xen is related to errors in processing the length of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2026-47547

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data...

CVE-2026-102798: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0...

PT-2026-104081

Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You versions prior to 3.15.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping during Paragraph Text field submissions...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-64370)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid506021; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

Persona Guardrail: A Production-Grade Defense Framework for Agentic Systems

Large language model-based agents are increasingly deployed to perform domain-specific tasks by interacting with enterprise knowledge, tools, and external services. Existing runtime guardrails primarily target prompt injection and other attack-specific behaviors under a black-box threat model, bu...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-64413)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid506008; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

PT-2026-104144

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on the...

PT-2026-104119

Name of the Vulnerable Software and Affected Versions CMB2 versions prior to 2.13.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By exploiting the parameter such as kl code or kl post code, an attacker can...

PT-2026-104142

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-104148

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-104141

Name of the Vulnerable Software and Affected Versions No External Links versions prior to 5.2.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

PT-2026-104143

Name of the Vulnerable Software and Affected Versions The Newsletter – Send awesome emails from WordPress versions prior to 9.4.1 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious...