CVE-2026-96564 SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

EUVD-2026-91905

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-96564 SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-94378

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-94378 SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-91878

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-94378

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5.3 . The root cause is insufficient input sanitization and output escaping of the 'name' parameter . This allows...

CVE-2026-94378 SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

POC_CVE-2024-40492

CVE-2024-40492：存储型XSS导致账户接管 描述 存储型跨站脚本（XSS）是一种常见于Web应用程序的安全漏洞。当攻击者能够将恶意脚本注入Web应用程序，并且这些脚本存储在服务器上时，就会发生这种情况。当其他用户访问包含恶意脚本的数据时，该脚本会在他们的浏览器中执行。 复现步骤 1. 访问 https://app.heartbeat.chat/ 2. 使用以下详细信息创建账户： 名字： giongfnef"test" 姓氏： giongfnef" 3. 进入“Threads”，然后搜索名字 giongfnef - XSS被触发 - 这是存储型XSS，可能导致账户接管 POC...

CVE-2026-94378: Improper Neutralization of Input During Web Page Generation

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-104509

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the author display name. Unauthenticated attackers...

PT-2026-104484

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96564: Improper Neutralization of Input During Web Page Generation

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2026-104503

Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

CVE-2026-71889: Improper Certificate Validation

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

Linux Distros Unpatched Vulnerability : CVE-2026-71889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy...

PT-2026-104562

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

NPM: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

NPM: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler POST /api/v1/query via unsanitized window-function name vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

Summary A cross-tenant SQL injection in the TSQL query compiler lets any authenticated trigger.dev customer read every other tenant's analytics data. The customer-facing query endpoint POST /api/v1/query accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by internal-packages/tsql. The...

IDARustDemangler

IDA Rust Demangler Este proyecto proporciona un script que desmagla los nombres de funciones de Rust y los normaliza para IDA, facilitando la lectura y comprensión del código. Requisitos Python 3.x IDA Pro 7.x o posterior Dependencias El algoritmo de demangling utilizado en este script se basa en...