EUVD-2026-75099

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Zero is a valid random number and needs to be allowed. Otherwise the output is distinguishable from random...

CVE-2026-80922 crypto: qcom-rng - Allow zero as a random number

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Zero is a valid random number and needs to be allowed. Otherwise the output is distinguishable from random...

CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

CVE-2026-86772

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting (XSS) vulnerability in DepartmentPresenter::formattedNameLink() . Department names are rendered unescaped in the fallback branch shown to users lacking the departments.view permission. An attacker with departments.edit permissio...

CVE-2026-79952

Dell Secure Connect Gateway (SCG) 5.0 is affected by an Improper Encoding or Escaping of Output vulnerability in both the Appliance (versions prior to 5.36.00.16 ) and Application (versions prior to 5.36.00.00 ). An unauthenticated attacker with remote network access could exploit this flaw to la...

CVE-2026-79952

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of...

CVE-2026-79952

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of...

Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to ImproperImproper Encoding or Escaping of Output

Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34480 Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including...

CVE-2026-83593 WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-19945

The WP Crowdfunding plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via the first_name parameter in all versions up to and including 2.2.1 , caused by insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can i...

CVE-2026-84293

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-75966

The Podlove Podcast Publisher WordPress plugin (all versions ≤ 4.5.5) is vulnerable to Stored Cross-Site Scripting via the episode_contributor[..][..][comment] parameter. The root cause is insufficient input sanitization and output escaping: the contributor comment is stored in a plugin-managed c...

EUVD-2026-74604

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

EUVD-2026-74603

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-74601

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpffid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-84293 Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84293

The Repeater Fields for Gravity Forms WordPress plugin (versions up to and including 3.0.4 ) is vulnerable to Stored Cross-Site Scripting via repeated multi-input sub-field values due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web script...

CVE-2026-84293 Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...