CVE-2026-55850

Element Web (a Matrix web client) prior to 1.12.22 is vulnerable to HTML injection via the EmbeddedPage component (apps/web/src/components/structures/EmbeddedPage.tsx). The component renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedH...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 260 vulnerabilities disclosed in 200 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 142 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Exploit for CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in P...

Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

MAL-2026-14354 Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Pods WordPress Plugin

On August 10th, 2026, we received a submission for an Unauthenticated Privilege Escalation vulnerability in Pods, a WordPress plugin with more than 100,000 active installations. This vulnerability allows unauthenticated attackers to escalate their privileges to administrator and perform various...

CVE-2026-76611

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

EUVD-2026-63939

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

CVE-2026-76611

Zoo is a Joomla extension developed by yootheme.com . The Gallery element in Zoo versions prior to 4.1.66 is vulnerable to unauthenticated arbitrary directory listing , allowing a remote attacker over the network to list directory contents without any authentication or user interaction. The CVSS ...

CVE-2026-76611 Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

CVE-2026-76611 Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to dojo.profile-1.9.7.js (CVE-2021-23450, CVE-2008-6681, CVE-2010-2273)

Summary dojo.profile is vulnerable to Prototype Pollution flaw, Cross-Site Scripting XSS attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2021-23450 DESCRIPTION: All versions of package dojo are vulnerable to Prototype Pollution via the setObject functio...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to qs-6.13.0.tgz (CVE-2026-2391)

Summary qs is vulnerable to a Improper Input Validation attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated values when comma: true is enabled, allowing...

CVE-2026-77755

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...

CVE-2026-48590

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2,...

CVE-2026-47079

Inappropriate Encoding for Output Context vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...

CVE-2026-77755 Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...

CVE-2026-77755 Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...

EUVD-2026-63881

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...