PT-2026-85530

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

PT-2026-85643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The fdp nci i2c read function fails to validate the packet length provided by the device. This value is used as the count for i2c master recv into a 261-byte on-stack buffer. A malicious...

PT-2026-85431

UNSUPPORTED WHEN ASSIGNED Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the...

PT-2026-85475

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects Menulux Portal: before 20260903211448...

PT-2026-85533

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

PT-2026-85525

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash fileupload process' function, which iterates through an entire array and validates only the first file. This...

PT-2026-85471

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

PT-2026-85612

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the joycon input create function, the input register device function was called before joycon config rumble could configure the FF RUMBLE capability and the memless force-feedback...

PT-2026-85613

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the joycon ctlr read handler function. The function casts an incoming HID input report to struct joycon input report but only performs a 12-byte length...

PT-2026-85623

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the magicmouse driver where the magicmouse input mapping function caches the first hid input's input dev in the msc-input variable during report descriptor parsing. If...

CVE-2026-84947: Improper Input Validation

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

CVE-2026-84947: Improper Input Validation

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

PT-2026-85448

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

CVE-2026-84469: Improper Input Validation

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-84504: Improper Input Validation

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

HPESBNW05141 rev.1 - HPE Telco Network Function Virtual Orchestrator, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Multiple Vulnerabilities, Unauthorized Remote Access, memory corruption, Buffer Overflow, Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Network Function Virtualization Orchestrator v7.7.0 or bel...

PT-2026-85780

CVE-2026-38961: Stored XSS in Netgate pfSense RSS Widget versions 26.03, 25.11.1, CE 2.8.1. Malicious feed titles execute JS for any authenticated user viewing the dashboard. CVSS: N/A. Unpatched—restrict RSS access now. Details: https://t.co/XaOt7Xazw4 cybersecurit valtersit CVE CVEAlert infosec...

PT-2026-85527

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

ROS-20260904-73-0006

The vulnerability in php-phpseclib is related to manipulating an unknown input, resulting in a time mismatch. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...