CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

K000162877: NLnet Labs Unbound vulnerability CVE-2026-44390

Security Advisory Description NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above...

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...

MAL-2026-13864 Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CGA-7H9F-9CJ5-242V

Bulletin has no description...

CVE-2026-18049

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...

CVE-2026-16066 Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-16066

The Welcart e-Commerce WordPress plugin, in versions prior to 2.11.34 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise or escape a product field before it is rendered on product pages. This allows users with the Author role or higher ...

ECHO-D0F5-0786-800C

Bulletin has no description...

F5 Networks BIG-IP : NLnet Labs Unbound vulnerability (K000162877)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5 / 17.5.1.9 / 21.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K000162877 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with...

WordPress FluentSMTP cross-site scripting vulnerability

WordPress FluentSMTP is a fully free and powerful WordPress plugin designed to take over the default email sending mechanism wpmail. By configuring an external SMTP service, it improves the email delivery rate, and it supports multiple SMTP connection routes, such as distinguishing between...

CVE-2026-17082: Improper Privilege Management

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name...

CVE-2026-62420: Incorrect Authorization

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

PT-2026-71268

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can gain elevated privileges due to improper validation of a client-supplied profile name. Recommendations At the moment, there is no information about a newer version...

CVE-2026-70560: Improper Neutralization of Input During Web Page Generation

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-17445: Execution with Unnecessary Privileges

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name...