UBUNTU-CVE-2026-51297

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-16410

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

CVE-2026-16392

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

Cross Site Scripting

Grav is vulnerable to Cross Site Scripting. The vulnerability is due to the XSS blueprint validator running on raw page content before Twig processing, where an attacker with page-write API permission can use Twig's string concatenation operator to dynamically construct event handler names, and...

CVE-2026-14827

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...

CVE-2026-14190

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

CVE-2026-14203

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-14827

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...

EUVD-2026-49084

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...

CVE-2026-14190

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

CVE-2026-14190

The Sina Extension for Elementor WordPress plugin (versions before 3.10.2 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape values reconstructed from request input within an unauthenticated AJAX handler before they are reflected into the HTML ...

CVE-2026-14203

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-14203

The Smart Manager WordPress plugin, in versions before 8.92.0 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper encoding of a post field before it is rendered into an HTML attribute within the plugin's management grid. This allows users with Contributor p...

Linux Distros Unpatched Vulnerability : CVE-2026-13071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript...

CVE-2026-59239: Improper Neutralization of Input During Web Page Generation

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-66030: Improper Neutralization of Input During Web Page Generation

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...

CVE-2026-66825: Improper Neutralization of Input During Web Page Generation

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

PT-2026-64982

Name of the Vulnerable Software and Affected Versions sqlite version 3.41 Description A use-after-free issue exists in the JSON extraction function. The problem occurs when the program continues to access internal members of a freed pointer after the JsonParse object memory has been released via...

PT-2026-65104

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

PT-2026-64851

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...