PT-2026-105083

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded for...

Rocky Linux 9 [CIQ] Security Update: mod_auth_openidc / mod_auth_openidc-debuginfo / etc (crlsa-2025_9396)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259396 advisory. modauthopenidc: DoS via Empty POST in modauthopenidc with OIDCPreservePost Enabled CVE-2025-3891 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: mod_auth_openidc (ALMALINUX9.2:CLSA-2025:1746188656)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746188656 advisory. - modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID...

Rocky Linux 8 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel / etc (crlsa-2025_4597)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20254597 advisory. modauthopenidc: DoS via Empty POST in modauthopenidc with OIDCPreservePost Enabled CVE-2025-3891 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2024_1601)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241601 advisory. curl: information disclosure by exploiting a mixed case flaw CVE-2023-46218 curl: more POST-after-PUT confusion CVE-2023-28322 curl: cookie injection with...

CVE-2026-103285: Cross-Site Request Forgery (CSRF)

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when...

PT-2026-103817

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when...

Rocky Linux 8 [CIQ] Security Update: varnish / varnish-devel / varnish-docs / varnish-modules / etc (crlsa-2021_2988)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212988 advisory. varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request CVE-2021-36740 Tenable has extracted the preceding description block...

Ubuntu 26.04 LTS : Kdenlive, MLT vulnerability (USN-8856-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8856-1 advisory. It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute...

CVE-2026-100510

Unauthenticated Cross Site Scripting XSS in Post and Page Builder by BoldGrid = 1.27.14 versions...

CVE-2026-100510

The Post and Page Builder by BoldGrid WordPress plugin, version 1.27.14 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability. While the specific underlying cause or affected function is not detailed in the provided documents, the vulnerability allows for networ...

CVE-2026-100510 WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Post and Page Builder by BoldGrid = 1.27.14 versions...

EUVD-2026-90219

Unauthenticated Cross Site Scripting XSS in Post and Page Builder by BoldGrid = 1.27.14 versions...

CVE-2026-100510 WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Post and Page Builder by BoldGrid = 1.27.14 versions...

USN-8856-1 kdenlive, mlt vulnerability

It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties...

USN-8856-1: Kdenlive, MLT vulnerability

It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties...

WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Post and Page Builder by BoldGrid versions = 1.27.14...

Exploit for CVE-2026-97347

CVE-2026-97347 — Stored XSS in Post Views Stats Counter WordP...

CVE-2026-97347

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-102581 Moodle: xss in forum post templates due to insufficient escaping

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...