CVE-2026-78213

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

CVE-2026-78213

Heptabase , developed by Hepta Platforms, Inc., is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content. Th...

EUVD-2026-64720

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

PT-2026-79821

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

Johnson Controls Metasys 12.x / 13.x / 14.x < 14.1.5 / 15.x < 15.0.1 Cross-Site Scripting (CVE-2026-34491)

A low-privilege user can inject a malicious XSS payload into the Johnson Controls Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. Successful exploitation of this vulnerability could allow a low-privileg...

CVE-2026-56750

A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability ca...

CVE-2026-66594

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

EUVD-2026-63337

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66594

The WordPress Persistent Login plugin (versions ≤ 3.1.0) has a subscriber-level SQL injection vulnerability exploitable over the network with low privileges. CVSS 8.5 (HIGH) reflects high confidentiality impact and low availability impact. No in-the-wild exploitation is reported. Upgrade to a ver...

CVE-2026-66594: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests

cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests...

PT-2026-78958

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-76374

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

EUVD-2026-62845

IBM PowerVM Hypervisor Platform KeyStore PKS and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could...

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

Malicious code in libas-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25 On require of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites...

MAL-2026-14263 Malicious code in arb-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef3587f45144a9473e246cbffd1c4d03c2f895aa5052801282c4e1dd3e76be30 arb-kit advertises itself as an Arbitrum ABI/gas toolkit, but the main entry index.js contains an IIFE that, 37 seconds after require, reads a base64...

MAL-2026-14260 Malicious code in ranux-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2 package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant...