PT-2026-71081

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource tags, assembled by unroll dict and parse html string, into generated reports without HTML escaping, allowing a cloud principal who can modify a...

CVE-2026-18710 Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813

Vulnerability summary (CVE-2026-48813) : Flawfinder (C/C++ static analysis tool) versions prior to 2.0.20 are affected by improper input neutralization causing output manipulation. Specifically, untrusted inputs (filenames, categories, code context) can introduce Terminal/ANSI Escape Sequence Inj...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

EUVD-2026-56901

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-72742

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

CVE-2026-72742

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters. By injecting a filesystem path into the URL field of a parsed Image or Audio output, untrusted language model completions are parsed via TypeAdapter validation, triggering encode_image/encode_aud...

CVE-2026-68180

A flaw was found in the intelth Intel Trace Hub driver within the Linux kernel. This vulnerability occurs because the intelthoutputopen function acquires a device reference that is not properly released by the intelthmscrelease function when handling Message Signaled Interrupt MSC outputs...

CVE-2026-16974

The CVE concerns the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. It is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to 6.2.0 due to insufficient input sanitization and output escaping. Consequence: authenticated attacke...

EUVD-2026-55934

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16974 Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-70056

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1 Description Insufficient input sanitization and output escaping in the post meta Shortcode allow authenticated attackers with Contributor-level access or highe...

PT-2026-70872

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

PT-2026-70101

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software improperly handles conversion-table values within the search highlighting feature. The highlight function either returns underlying text directly when no search query is...

CVE-2025-15680

TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system...

CVE-2026-72743 SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...