Exploit for CVE-2026-44402

CVE-2026-44402 Pre-Authenticated Full Remote Command Executio...

MAL-2026-13815 Malicious code in hngfykuvgh4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb74c94bd8f989f94db4ca0856a3b312b7bb3a71278fde98da36e42eda76bd4c Package contains a single index.html declared as main that impersonates a Cloudflare 'Just a moment…' verification page, embedding a real Turnstile...

RHSA-2026:54191 Red Hat Security Advisory: rhc-worker-script security update

Bulletin has no description...

Important: Red Hat Security Advisory: rhc-worker-script security update

An update for rhc-worker-script is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-17013

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

EUVD-2026-57092

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013

The WP Photo Album Plus WordPress plugin (versions prior to 9.2.07.002 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a parameter—specifically identified as lbstart —before reflecting it into an inline script block. This allows unaut...

CVE-2026-15249 Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-16066

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

EUVD-2026-57083

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-9318 tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

WordPress Forminator cross-site scripting vulnerability

WordPress Forminator is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Forminator has a cross-site scripting vulnerability. This vulnerability arises from ForminatorCore::sanitizearray, which skips fields starting with “select”, and setfieldda...

CVE-2026-73490: Improper Neutralization of Input During Web Page Generation

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

PT-2026-75981

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only strip tags applied directly into $pagetitle. A single quote terminates the JS string, executing...

RHEL 7 : rhc-worker-script (RHSA-2026:54191)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:54191 advisory. Remote Host Configuration rhc worker for executing scripts on hosts managed by Red Hat Lightspeed. Security Fixes: net/url: Incorrect parsi...