CVE-2026-84151

The Post Grid WordPress plugin versions prior to 7.9.5 is vulnerable to HTML injection due to an improper limitation of the WordPress allowed-HTML list. Specifically, the plugin fails to restrict the expansion of this list to its own markup, applying it site-wide. This allows users with the Contr...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

WordPress The Post Grid plugin < 7.9.5 - Contributor+ Stored HTML/iframe Injection vulnerability

Contributor+ Stored HTML/iframe Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin The Post Grid versions 7.9.5...

EUVD-2026-85800

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-79763: Use of Single-factor Authentication

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

PT-2026-98290

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-84151: Improper Neutralization of Input During Web Page Generation

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-97056: Insufficient Session Expiration

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

PT-2026-97855

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0 through 4.1.5 Description An authentication bypass exists in the public two-factor authentication 2FA verification flow. An unauthenticated attacker can take over any account that has 2FA enabled, including administrato...

PT-2026-97775

Name of the Vulnerable Software and Affected Versions WP Multilang – Translation and Multilingual Plugin versions prior to 2.4.32 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site...

CVE-2026-93354: Initialization of a Resource with an Insecure Default

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-15731: Improper Neutralization of Input During Web Page Generation

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-79759: Authorization Bypass Through User-Controlled Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-93235: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

PT-2026-97918

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. The POST '/credentials/:id/deploy-to-host' endpoint fails to verify if the records associated...

CVE-2026-91134: Improper Input Validation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowediframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form...

PT-2026-97921

Name of the Vulnerable Software and Affected Versions Termix versions 2.4.0 through 2.5.0 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. A regression in the reauthentication process allows the endpoints 'POST /users/totp/disable'...

CVE-2026-93235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

PT-2026-97923

Name of the Vulnerable Software and Affected Versions Termix versions 2.4.1 through 2.5.0 Description An authenticated administrator can execute arbitrary operating-system commands as the backend process. This occurs because the application fails to properly sanitize domain and email values store...

PT-2026-98154

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The post sanitizer allows a stored cross-origin iframe to bypass the allowed iframe...