EUVD-2026-125361

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5...

CVE-2026-124410 WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpLingua Translation Service Translate and boost SEO Automatic AI translation wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO Automatic AI translation wpLingua: from...

CVE-2026-121721

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6...

CVE-2026-128029

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store,...

CVE-2026-126955

Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /page or /api/pages/page/content/ and compare 303/40...

CVE-2025-71462

Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after log...

CVE-2025-71462 Zipline before 3.7.12 XSS via url parameter on login page

Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after log...

CVE-2025-71462

Zipline versions before 3.7.12 are vulnerable to a cross-site scripting (XSS) vulnerability on the login page. The root cause is an unvalidated url parameter that allows an attacker to execute arbitrary JavaScript by crafting a login link containing a javascript: URI . When a victim clicks this l...

EUVD-2025-211319

Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after log...

CVE-2026-126939

Versions of Zipline prior to 4.6.4 are vulnerable to an information disclosure flaw in the GET /api/server/folder/:id endpoint. An unauthenticated attacker who possesses a folder UUID can supply a page query parameter to bypass the metadata-only early return. This allows for the enumeration of fi...

CVE-2026-126955

The Glance application (versions 0.8.0 before 0.8.8 ) is vulnerable to page slug enumeration due to an observable response discrepancy in the handlePageRequest and handlePageContentRequest functions. This flaw allows unauthenticated attackers to discover hidden page names by requesting candidate ...

EUVD-2026-125110

Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /page or /api/pages/page/content/ and compare 303/40...

EUVD-2026-125073

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store,...

CVE-2026-128029

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue exists in the Dataflow profile run page , where catalog product import row errors are inserted into the page without proper escaping. Unauthentic...

CVE-2026-123124

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripti...

EUVD-2026-124845

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripti...

CVE-2026-123124

The WooCommerce Vindi Pagamento WordPress plugin (versions through 0.8.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue stems from a lack of authorization checks when updating an order's shipment tracking code and a failure to escape that code when it is displayed on the order e...

copyfail-check

copyfail-check !IMPORTANT This repository is archived. The Copy Fail check now lives in cve-check , together with other vulnerability checks and an optional --fix mode that applies the remediation. See checks/CVE-2026-31431 for this check. curl -fsSL...

SUIDGuard

SUIDGuard - A kernel extension adding mitigations to OS X to make exploitation harder Copyright c Stefan Esser / SektionEins GmbH, 2015. All rights reserved. [email protected] - https://www.sektioneins.de/ OFFICIAL WEBSITE If you came here from a media article please checkout the official...

copy-fail-cve-2026-31431

Copy Fail - CVE-2026-31431 This repository provides a Go port of the public Copy Fail PoC and a reproducible build pipeline for multi architecture Linux binaries. Copy Fail CVE-2026-31431 is a Linux kernel logic flaw in authencesn that enables a deterministic 4 byte write into page cache data...