PT-2026-104079

Name of the Vulnerable Software and Affected Versions Autoptimize versions prior to 3.1.15.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

PT-2026-104142

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-104148

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-104145

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-104141

Name of the Vulnerable Software and Affected Versions No External Links versions prior to 5.2.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

RockyLinux 10 : ghostscript (RLSA-2026:74464)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:74464 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly from t...

RHEL 9 : ghostscript (RHSA-2026:74457)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74457 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats...

ROS-20261002-73-0016

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0020

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-90438: Improper Neutralization of Input During Web Page Generation

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-87920: Improper Neutralization of Input During Web Page Generation

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-104177

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via comment content. This...

CVE-2026-96578: Improper Neutralization of Input During Web Page Generation

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-95817: Improper Neutralization of Input During Web Page Generation

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

AlmaLinux 10 : ghostscript (ALSA-2026:74464)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:74464 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly from th...

Persona Guardrail: A Production-Grade Defense Framework for Agentic Systems

Large language model-based agents are increasingly deployed to perform domain-specific tasks by interacting with enterprise knowledge, tools, and external services. Existing runtime guardrails primarily target prompt injection and other attack-specific behaviors under a black-box threat model, bu...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...

PYSEC-2026-4032 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

Moderate: Red Hat Security Advisory: ghostscript security update

An update for ghostscript is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter

A flaw was found in Ghostscript. This heap-based buffer overflow vulnerability in the JPEG 2000 output adapter allows an attacker to cause memory corruption by supplying a specially crafted PDF file. The crafted PDF contains a JPEG 2000 image with mismatched component subsampling factors...