CVE-2026-13203

CVE-2026-13203 is a Stored Cross-Site Scripting (XSS) vulnerability in the Live Composer – Free WordPress Website Builder plugin, affecting versions up to 2.1.19 . The root cause is insufficient sanitization and output escaping of the custom_id shortcode attribute in the dslc_modules_section and ...

CVE-2026-16787

The Live Composer – Free WordPress Website Builder plugin (versions up to and including 2.1.19 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the dslc_custom_field shortcode, caused by insufficient input sanitization and output escaping . Authenticated attackers with contributor-level a...

PT-2026-84536

Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description The setTitle and setDescription functions in Live schedule store POST input without proper sanitization. This allows users with streaming permissions to inject malicious scripts. Additionally,...

PT-2026-84101

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.20 Description Insufficient input sanitization and output escaping in the dslc custom field shortcode allow authenticated attackers with contributor-level access or higher to...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'dslccustomfield' Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'customid' Shortcode Attribute vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

SUSE SLES12 Security Update : kernel (Live Patch 84 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3808-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3808-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.317 fixes various security issues: The following security issues were fixed: -...

SUSE SLES12 Security Update : kernel (Live Patch 79 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3826-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3826-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.299 fixes various security issues: The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:3807-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3807-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.177 fixes various security issues: The following security issues were fixed:...

SUSE SLES15 Security Update : kernel (Live Patch 29 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:3819-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3819-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.125 fixes various security issues: The following security issues were fixed: -...

SUSE SLES12 Security Update : kernel (Live Patch 85 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3820-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3820-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.320 fixes various security issues: The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3821-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3821-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-80642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while th...

SUSE SLES15 Security Update : kernel (Live Patch 57 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:3829-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3829-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.228 fixes various security issues: The following security issues were fixed:...

CVE-2026-82645

AVideo (commit e01e41ecc and earlier) is vulnerable to unauthenticated stream credential disclosure via the getLiveKey.json.php endpoint. Supplying a forged token parameter bypasses both the access gate and ownership check, returning any user's stream_key and stream_url — credentials for external...

CVE-2026-81733

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

EUVD-2026-67684

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

CVE-2026-80642

CVE-2026-80642 affects the Linux kernel 's liveupdate subsystem. During a Live Update, a subsystem may need to hold incoming File-Lifecycle-Bound (FLB) data for an extended period (e.g., during device enumeration). The vulnerability stems from a missing reference count on the incoming FLB structu...

SUSE SLES15 Security Update : kernel (Live Patch 25 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:3760-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3760-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.109 fixes various security issues: The following security issues were fixed: -...