CVE-2026-12536: Improper Neutralization of Input During Web Page Generation

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-57858

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-57626

A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Module. Such manipulation of the argument Name/Username leads to cross site scripting. The attack can be executed remotely. The exploit is...

PT-2026-57582

A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a...

PT-2026-59696

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parse op part function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Althoug...

PT-2026-60075

Name of the Vulnerable Software and Affected Versions DIRAC versions prior to 8.0.79 DIRAC versions prior to 9.0.22 DIRAC versions prior to 9.1.10 Description Remote code execution is possible in RequestManager because the export getRequestCountersWeb function passes parameters directly to the...

PT-2026-59312

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file dey mini.yaml under the key 'nnet''module'...

ALSA-2026:38847 Important: nginx:1.24 security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

Important: nginx:1.24 security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

Progress MOVEit Transfer 2022.1.x / 2023.0.x < 2023.0.17 / 2023.1.x < 2023.1.12 / 2024.0.x < 2024.0.8 / 2024.1.x < 2024.1.2 Privilege Escalation (March 2025)

The version of Progress MOVEit Transfer, formerly Ipswitch MOVEit DMZ, installed on the remote host is affected by a privilege escalation vulnerability as referenced in Progress Community article 000256795. - Improper Privilege Management vulnerability for users configured as Shared Accounts in...

PT-2026-59261

Summary A Server-Side Request Forgery SSRF vulnerability exists in LMDeploy's vision-language module. The load image function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, a...

PT-2026-57713

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from...

Explaining Intrusion Alert Decisions of Deep Learning-Based Network Intrusion Detection Systems for Security Analysts

In this paper, we present EXP-SEC, a novel framework which can explain the intrusion detection decisions of DL-based NIDS which lead to security alerts in a way that is aligned with the domain knowledge of analysts working in Security Operations Center SOC. We highlight the following features of...

PT-2026-59580

Summary praisonaiagents resolves unresolved tool names against module globals and main after it fails to match the declared tool list and the registry. With the default agent configuration, perm allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An...

PT-2026-59549

Summary praisonaiagents resolves unresolved tool names against module globals and main after it fails to match the declared tool list and the registry. With the default agent configuration, perm allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An...

PT-2026-59300

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html to markdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources...

ROS-20260713-73-0022

The vulnerability of the Perl module from the zlib library is related to incorrect input of configuration data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-60064

Name of the Vulnerable Software and Affected Versions Decidim versions 0.31.1 through 0.31.4 Decidim version 0.32.0.rc1 Description An authorization bypass allows a normal participant to access the demographics questionnaire editor without the required administrator privileges. By directly loadin...

CVE-2026-15516: Authorization Bypass Through User-Controlled Key

A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a...

CVE-2026-15532: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Module. Such manipulation of the argument Name/Username leads to cross site scripting. The attack can be executed remotely. The exploit is...