CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84369

SVGO (SVG Optimizer), a Node.js library and CLI for optimizing SVG files, contains a sanitization gap in its opt-in removeScripts plugin (v1.0.0 through 2.8.3 / 3.3.4 / 4.0.x). The plugin removes SVG and XHTML [removed] elements but does not inspect executable HTML content inside SVG foreignObjec...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-73704

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system...

EUVD-2026-69431

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system...

CVE-2026-73704 Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system...

CVE-2026-73704

A command sanitization bypass in the API of HPE Networking Fabric Composer allows an authenticated low-privilege operator to escalate to administrative access , resulting in complete system compromise. The vulnerability is classified as Authenticated Command Injection per the CVELIST record. The ...

CVE-2026-73704 Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

CVE-2026-10195 FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

EUVD-2026-69300

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-10195

FS-Poster WordPress plugin (versions up to and including 8.0.1 ) is vulnerable to authenticated remote code execution via insufficient sanitization of the FFmpeg path parameter before it is passed to the exec() function, combined with missing authorization checks on REST API endpoints. Attackers ...

SUSE-SU-2026:3916-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

CVE-2026-7877

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-19471

Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page...

EUVD-2026-69061

Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page...

CVE-2026-19471 Rockwell Automation ArmorStart® LT Stored Cross-site scripting

Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page...

CVE-2026-19471

Rockwell Automation ArmorStart® LT is affected by multiple stored cross-site scripting (XSS) vulnerabilities. The root cause is improper sanitization of user input that is stored on the server, enabling an attacker to inject malicious scripts that execute when other users access the affected page...