CVE-2026-111318

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

EUVD-2026-112693

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

Security Updates for Microsoft Dynamics NAV 2018 (Oct 2026)

The Microsoft Dynamics NAV 2018 install is missing a security update. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data allows an authorized attacker to execute code over a network. CVE-2026-100214 - Improper limitation of a pathname to a restricted...

Security Updates for Microsoft Dynamics NAV 2017 (Oct 2026)

The Microsoft Dynamics NAV 2017 install is missing a security update. It is, therefore, affected by a vulnerability: - Deserialization of untrusted data allows an authorized attacker to execute code over a network. CVE-2026-100214 Note that Nessus has not attempted to exploit this issue but has...

Microsoft Dynamics NAV Auth Bypass Info Disclosure

The vulnerability of the integrated business management system Microsoft Dynamics NAV lies in the lack of authentication for critical functions. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Microsoft Dynamics NAV Privilege Escalation

The vulnerability of the integrated Microsoft Dynamics NAV enterprise management system is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

WordPress Tutor LMS Cross-site Scripting Vulnerability

WordPress Tutor LMS versions 4.1.0 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'tab' parameter. Additionally, when the nav-items array of the target course page is empty, the inarray validation can be...

PT-2026-118114

Уязвимость интегрированной системы управления предприятием Microsoft Dynamics NAV связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию...

PT-2026-118112

Уязвимость интегрированной системы управления предприятием Microsoft Dynamics NAV связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, повысить свои привилегии...

Malicious code in epic-games-nav (npm)

Source: amazon-inspector 7a2358b48b0499482e090fff386dcd3063342ed33d1a73ee900be5199e6bad00 The package epic-games-nav was found to contain malicious code. --- Credit: OpenSSF source...

coop (4.0.0), wagtail-grapple (>=0.16.1, <=0.17.1) +4 more potentially affected by CVE-2026-55468 via wagtail (4.0.4)

wagtail PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop 4.0.0 - wagtail-grapple =0.16.1, =0.17.1 - wagtail-hallo 0.2.0 - wagtail-nav-menus 3.9.2 - wagtail-streamfield-migration-toolkit 0.1.0 -...

Malicious code in accessibility-nav (npm)

--- Credit: OpenSSF source...

puput (2.0.0), wagtail-all-in-one-accessibility (>=1.1.0, <=1.8.0) +4 more potentially affected by unknown CVE via wagtail (5.0.5)

wagtail PYPI version 5.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - puput 2.0.0 - wagtail-all-in-one-accessibility =1.1.0, =5.0.0, =3.10.1, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory:...

puput (2.0.0), wagtail-all-in-one-accessibility (>=1.1.0, <=1.8.0) +4 more potentially affected by unknown CVE via wagtail (5.0.5)

wagtail PYPI version 5.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - puput 2.0.0 - wagtail-all-in-one-accessibility =1.1.0, =5.0.0, =3.10.1, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory:...

Microsoft Dynamics NAV Code Execution

The vulnerability in the integrated enterprise management system of Microsoft Dynamics NAV is related to flaws in the deserialization mechanism. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Malware in @nebula.js/sn-nav-menu

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-15645

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-15645 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-15645 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-15645

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...