CVE-2026-128041

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that...

EUVD-2026-125067

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that...

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

The Import XML and RSS Feeds WordPress plugin before 2.1.5 allows unauthenticated attackers to execute arbitrary commands via a web shell. id: CVE-2023-4521 info: name: Import XML and RSS Feeds 2.1.5 - Unauthenticated RCE author: princechaddha severity: critical description: The Import XML and RS...

ThreatIntel-Aggregator

Threat Intel Aggregator A self-hosted threat intelligence platform that aggregates RSS feeds from 60+ security vendors, runs AI triage, correlates findings against your RunZero asset inventory, and surfaces actionable alerts through a dark-mode web dashboard. Built to run standalone with zero clo...

CVE-2026-123202

A flaw was found in libnxml. This vulnerability allows a remote attacker to cause a Denial of Service DoS by crashing applications that process untrusted data. By supplying specially crafted XML or RSS feeds containing excessively long names ending in multi-byte characters, an attacker can trigge...

CVE-2026-123202

libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxmlparser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a...

EUVD-2026-117647

libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxmlparser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a...

CVE-2026-53631

GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. Thi...

CVE-2026-53631 GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds

GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. Thi...

CVE-2026-53631

The GLPI asset and IT management software package is vulnerable to an unauthorized visibility expansion affecting knowledge base items, reminders, and RSS feeds. From versions 0.83 until 10.0.27 and 11.0.0 until 11.0.9 , any authenticated user can submit a crafted request to modify visibility set...

CVE-2026-53631 GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds

GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. Thi...

CVE-2026-53631 GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds

GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. Thi...

PT-2026-137232

Name of the Vulnerable Software and Affected Versions GLPI versions 0.83 through 10.0.26 GLPI versions 11.0.0 through 11.0.8 Description An authenticated user can submit a crafted request to modify the visibility of RSS feeds, reminders, or knowledge base items. This allows the user to access...

cve-intel-triage

cve-intel-triage Rank CVEs from security news feeds by what i...

PT-2026-115612

Name of the Vulnerable Software and Affected Versions Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental versions prior to 3.0.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored...

ai_bobao

aibobao AI-Powered Vulnerability Intelligence Feed Simp...

PT-2026-95100

Name of the Vulnerable Software and Affected Versions Glean versions prior to 0.2.6 Description An issue exists where the application fails to perform network-level validation on URLs provided in RSS feeds. When a user submits a feed url via the 'POST /api/feeds/discover' endpoint, the system...

CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-81348

The My Private Site WordPress plugin, specifically versions before 4.2.3 , contains a vulnerability where site-privacy access controls are not correctly applied to certain unauthenticated front-end read surfaces. This oversight allows unauthenticated users to view post content , comments , and po...

CVE-2026-82657 Admidio before 5.0.12 Authentication Bypass via RSS feeds

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post...