PT-2026-74497

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.2...

jmespath.rb Memory Leak DoS

The vulnerability of the library for querying and filtering JSON data, jmespath.rb, is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker who operates remotely to cause service failures...

RHEL 9 : thunderbird (RHSA-2026:49921)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49921 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

CVE-2026-69251: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

CVE-2026-52370: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

PT-2026-74225

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1...

PT-2026-67652

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

PT-2026-74226

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1...

PT-2026-74111

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 1.9.1-tuxcare.1...

RHEL 8 : thunderbird (RHSA-2026:49922)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49922 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

📄 Flowise 3.1.2 Authenticated Remote Code Execution

A proof of concept exploit for an authenticated remote code execution vulnerability in Flowise version 3.1.2. The vulnerability allegedly exists because several record-manager and agent-memory components parse user-controlled additionalConfig JSON and pass its properties directly to a TypeORM...

PT-2026-67648

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-52520

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...