277 matches found
CVE-2026-32570
Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...
EUVD-2026-93233
Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...
CVE-2026-32570 WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...
CVE-2026-32570
The Progressify - Progressive Web App (PWA) plugin for WordPress is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions
WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
WordPress Progressify - Progressive Web App PWA plugin = 1.6.0 - Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Progressify - Progressive Web App PWA versions = 1.6.0...
TCL-xss-Labs
XSS Lab — The Cyber Ledger 💸 If this project helps you, consider supporting it with a $10 donation to keep it growing. Link: https://rzp.io/rzp/zgkC6h5B An interactive, self-hosted XSS training platform with 33 progressively harder challenges — designed for hackers, pentesters, and developers who...
Astra Linux – Vulnerability in freerdp3
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, the progressivedecompresstileupgrade function detected mismatches using progressiverfxquantcmpequal, but only emitted a WLogWARN message; execution continued. The wrapped value 247 was used as a shift...
Astra Linux – Vulnerability in freerdp2
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The affected versions are vulnerable to an Out-of-Bounds Write vulnerability in the progressivedecompress function. This issue is likely due to incorrect calculations of the nXSrc and nYSrc...
CVE-2026-5108 Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...
CVE-2026-5108
The CVE concerns the WordPress plugin Super Progressive Web Apps (versions
CVE-2026-5108: Improper Neutralization of Input During Web Page Generation
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...
WordPress Super Progressive Web Apps plugin <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by lucsob in WordPress Plugin Super Progressive Web Apps versions = 2.2.43...
ROS-20260716-73-0030
The vulnerability of Google Chrome’s PWA components is related to access control errors. Exploiting this vulnerability allows a remote attacker to install arbitrary PWA applications...
Malicious code in @meego-progressive/cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a7205f38cfc6908e42b221ffcaf5118f3ef9891d4b1cc7c0798411cc7b0b349 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6632 Malicious code in @meego-progressive/cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a7205f38cfc6908e42b221ffcaf5118f3ef9891d4b1cc7c0798411cc7b0b349 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...
CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...
libpng 安全漏洞
libpng is an open-source PNG reference library developed by The PNG Development Group. It allows for the creation, reading, and writing of PNG graphic files. Version 1.8.0 of LIBPNG contains a security vulnerability. This vulnerability stems from the inter-frame block discard path in the...
CVE-2026-7080
A security vulnerability has been detected in Tenda F456 1.0.0.5. This impacts the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. Such manipulation of the argument delno leads to buffer overflow. The attack may be launched remotely. The exploit has been...
