CVE-2026-95656 dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

PT-2026-96857

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add watch ui snapshot of the file changedetectionio/blueprint/add watch ui/ init .py of the component Preview Endpoint. Performing a manipulation of the argument url results in...

CVE-2026-95656: Server-Side Request Forgery (SSRF)

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-90884 WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2026-90884

The WP Recipe Maker WordPress plugin (versions ≤ 10.8.1 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the 'notes' parameter , accessed via the REST Preview Endpoint . The root cause is insufficient input sanitization and output escaping. An authenticated attacker with Cont...

CVE-2026-90884 WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2026-79294

Moonshot AI Kimi (specifically v1.0 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the HTML artifact Preview rendering and can be delivered through the public Share view component. This vulnerability allows a remote attacker to execute arbitrary code, w...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

PT-2026-95386

Name of the Vulnerable Software and Affected Versions Moonshot AI Kimi versions prior to 2026-07-18 Description A Cross Site Scripting XSS issue exists where a remote attacker can execute arbitrary code. This occurs through the HTML artifact Preview rendering within the public Share view componen...

EUVD-2026-82973

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

Fedora 44 : evolution (2026-99a4ff5552)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-99a4ff5552 advisory. Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859. Tenable has extracted the preceding description block directly from the...

Fedora 43 : evolution (2026-1ea9bbcb29)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1ea9bbcb29 advisory. Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859. Tenable has extracted the preceding description block directly from the...

PT-2026-95344

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injectin...

WordPress Core <= 7.1 - Cross-Site Request Forgery to Theme Install and Preview vulnerability

Cross-Site Request Forgery to Theme Install and Preview vulnerability discovered by Paulos Yibelo, pwn.ai in WordPress core versions = 7.1...

CVE-2026-79294: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

Critical: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

Critical: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...