CVE-2026-102173 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

CVE-2026-106380

An ui misrepresentation flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553168380...

CVE-2019-19393

Rittal CMC PU III – Stored XSS PoC Application: Interface de gestion Web Rittal CMC PU III Appareils: CMC PU III 7030.000 Révision logicielle: De V3.11.002 à V3.15.704 Révision matérielle: De V3.00 à V6.01 Type d'attaque: Stored XSS Solution: Mettre à jour vers la révision logicielle V3.17.10 ou...

CVE-2026-106232

An ui misrepresentation flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522299740...

CVE-2026-105324

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

EUVD-2026-94153

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

CVE-2026-105324

An HTTP header injection vulnerability exists in the start-page-loader.cgi component of ADM . This flaw allows an unauthenticated remote attacker to read arbitrary files on the host system by sending a crafted HTTP request with injected headers via the state parameter . The attacker can exploit t...

CVE-2026-105324 An HTTP header injection vulnerability was found in the ADM

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's...

Linux Distros Unpatched Vulnerability : CVE-2026-106182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security...

Linux Distros Unpatched Vulnerability : CVE-2026-106342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromiu...

Linux Distros Unpatched Vulnerability : CVE-2026-106415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged...

Linux Distros Unpatched Vulnerability : CVE-2026-106348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to...

PT-2026-107463

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

PT-2026-107406

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...