CVE-2026-103339 WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0...

EUVD-2026-90802

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103064 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103343 WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14...

CVE-2026-103343 WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14...

CVE-2026-103343

The FluentForm plugin for WordPress (versions up to and including 6.2.14 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This issue is caused by the improper neutralization of input during web page generation within the plugin. An attacker could potentially execute malicious scripts ...

expat security update

An update is available for expat. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: Expat:...

CVE-2026-103289

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103278

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

kernel: xfrm: input: hold netns during deferred transport reinjection

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

EUVD-2026-90682

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103278

Ghost versions 5.8.0 before 6.34.0 are susceptible to a staff account takeover due to an input validation vulnerability within the admin iframe . Attackers possessing content publishing privileges can craft malicious pages that trigger this vulnerability when visited by active staff users. While ...

CVE-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

EUVD-2026-90671

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

Exploit for Improper Input Validation in Citrix Netscaler_Application_Delivery_Controller

pitscaler.com Static briefing served by the Cloudflare Worker...

Improper Input Validation

Astro is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of malformed port values in the HTTP Host header when constructing request URLs, which allows an attacker to trigger an uncaught TypeError that can cause the Node.js process to terminate and result in ...

CVE-2026-96573

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

CVE-2026-100184

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...