PT-2026-74498

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.2...

PT-2026-67652

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

PT-2026-73968

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.1...

CVE-2026-52370: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

PT-2026-67817

Name of the Vulnerable Software and Affected Versions SNOMED International Snowstorm versions prior to 10.12.2 SNOMED International Snowstorm versions prior to 10.9.3 Description A reflected Cross-Site Scripting XSS issue exists within the "Web Route" redirection functionality. This allows an...

PT-2026-74451

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1...

PT-2026-74111

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 1.9.1-tuxcare.1...

PT-2026-74226

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1...

PT-2026-74225

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1...

CVE-2026-69251: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

📄 Flowise 3.1.2 Authenticated Remote Code Execution

A proof of concept exploit for an authenticated remote code execution vulnerability in Flowise version 3.1.2. The vulnerability allegedly exists because several record-manager and agent-memory components parse user-controlled additionalConfig JSON and pass its properties directly to a TypeORM...

ALSA-2026:49921 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...

RHEL 8 : thunderbird (RHSA-2026:49922)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49922 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1453:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1453:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-52520

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...