EUVD-2026-90593

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 Reflected SVG XSS Reflected Cross-Site Scripting XSS via SVG Rendering in FuguHub https://vulners.com/cve/CVE-2025-65790 This repository documents a Reflected Cross-Site Scripting XSS vulnerability in FuguHub 8.1 , where SVG files containing inline JavaScript are...

EUVD-2026-90572

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-90545

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

ROOT-APP-NPM-CVE-2026-5079 CVE-2026-5079 in multer - Patched by Root

Root has patched CVE-2026-5079 in the multer package for Root:npm. Multiple fixed versions available...

CVE-2026-86610

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

ROOT-APP-NPM-CVE-2026-2391 CVE-2026-2391 in qs - Patched by Root

Root has patched CVE-2026-2391 in the qs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-24999 CVE-2022-24999 in qs - Patched by Root

Root has patched CVE-2022-24999 in the qs package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM Operational Decision Manager for Sept 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2026-87822 DESCRIPTION: t-digest versions 3.1 through 3.3 fail to validate centroid means during...

CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

EUVD-2026-90511

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

WordPress Download Manager plugin < 3.3.71 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Mark Moore in WordPress Plugin Download Manager versions 3.3.71...

CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-86610

The Download Manager WordPress plugin (versions before 3.3.71 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient sanitization and escaping of a package setting before it is rendered on a page; specifically, the sanitization logic fails to neutralize single quote...

CVE-2026-20224---XXE-Injection-en-Cisco-Catalyst-SD-WAN-Manager

CVE-2026-20224 - Cisco Catalyst SD-WAN Manager XXE Injection ⚠️ DISCLAIMER THIS TOOL IS EXCLUSIVELY FOR EDUCATIONAL AND RESEARCH PURPOSES This exploit is intended exclusively for authorized red team operations, penetration testing, and security research on systems where you have explicit written...

[SECURITY] Fedora 44 Update: uv-0.12.19-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

EUVD-2025-209823

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

Rocky Linux 9 [CIQ] Security Update: libdnf-plugin-subscription-manager / etc (crlsa-2023_4708)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234708 advisory. subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration CVE-2023-3899 Tenable has extracted th...

Rocky Linux 8 [CIQ] Security Update: jss / jss-debuginfo / jss-debugsource / jss-javadoc / ldapjdk / etc (crlsa-2021_2235)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212235 advisory. pki-server: Dogtag installer pkispawn logs admin credentials into a world-readable log file CVE-2021-3551 The PKI installer pkispawn logs admin credentials into a...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2024_9644)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249644 advisory. squid: vulnerable to a Denial of Service attack against Cache Manager error responses CVE-2024-23638 squid: Denial of Service processing ESI response conte...