PT-2026-63421

Name of the Vulnerable Software and Affected Versions Analog Way Picturall Quad Compact Mark II version 3.5.8 Description A local privilege escalation flaw exists in the core firmware due to improper privilege delegation and insufficient input validation within a maintenance script. The create...

CVE-2026-14985: Improper Limitation of a Pathname to a Restricted Directory

The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script...

The vulnerability in the /web/jquery/uploader/multi Uploadify.php script of the D-Link DNS-320 network storage software allows a attacker to execute arbitrary code and gain full access to the system.

The vulnerability in the /web/jquery/uploader/multiUploadify.php script of the D-Link DNS-320 network storage software relates to the unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and gain full access to the...

PT-2026-63324

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

Check Point SmartConsole Authentication Bypass Run Script RCE

This module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an application...

The vulnerability of Adobe Experience Manager’s content and media data management system lies in the insufficient protection of website structures, which allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the Adobe Media Encoder application relates to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using the DOM...

CVE-2026-65597: Improper Neutralization of Input During Web Page Generation

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

PT-2026-63536

Name of the Vulnerable Software and Affected Versions Search API Autocomplete versions 0.0.0 through 1.12.0 Description Improper neutralization of input during web page generation allows Reflected Cross-site Scripting XSS, a flaw where malicious scripts are injected into a web page and reflected...

Plone 2.5.5 < 4.3.16 / 5.0.x < 5.0.10 Multiple Vulnerabilities (HF 20171128)

The version of Plone installed on the remote host is 2.5.5 prior to 4.3.16, 5.0.x prior to 5.0.10. It is, therefore, affected by the following vulnerabilities: - When you visit a page where you need to login, sends you to the login form with a 'camefrom' parameter set to the previous url...

Local Privilege escalation vulnerability in Analog Way Picturall Quad Compact Mark II version 3.5.8

Overview Version 3.5.8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark ...

CVE-2026-43946

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...

CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-43946 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...

CVE-2026-47689 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper handling of namespaced or prefixed script elements and case-sensitive matching of JavaScript URIs in the removeScripts plugin. An attacker can execute arbitrary scripts in the context of...

SVGO removeScripts plugin leaves some executable scripts intact

Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...

GHSA-2P49-HGCM-8545 SVGO removeScripts plugin leaves some executable scripts intact

Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...

CVE-2026-65048

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

CVE-2026-15145

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...

MAL-2026-10977 Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eaa5c1d1ed763b9e392bd199c360d75b25531b287de9f224e5626e121d649d4 Analysis of lebinfmt 1.0.0 surfaced no behaviors matching supply-chain attack classes. No install-time or import-time network I/O, no credential or...