EUVD-2026-60570

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-75091

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-75091 Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

SUSE CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

SUSE CVE-2026-75006

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

PT-2026-76906

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-76915

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...

PT-2026-78247

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.40 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the target server...

PT-2026-79909

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

PT-2026-80453

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands in github.com/kubev2v/migration-planner...

CVE-2026-75838: Improper Neutralization of Input During Web Page Generation

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75091: Improper Neutralization of Input During Web Page Generation

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-75006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or...

PT-2026-78249

Name of the Vulnerable Software and Affected Versions Draft List versions prior to 2.6.5 Description Improper neutralization of input during web page generation in the David Artiss Draft List simple-draft-list plugin allows for Stored Cross-site Scripting XSS. Stored XSS occurs when an applicatio...

.NET: .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

GHSA-M283-3H24-438V VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

Affected: vm2 = 3.11.3 CVSS 3.1: 9.9 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-693 Protection Mechanism Failure Prerequisite: Embedder exposes a host function that throws an Error with .cause referencing a powerful host object e.g., process Summary I found that handleException in...