CVE-2026-81167: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

CVE-2026-84438: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84437: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

CVE-2026-19719: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

CVE-2026-81288: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

CVE-2026-84781: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...

CVE-2026-81775: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

PT-2026-84685

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

PT-2026-84693

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

PT-2026-84690

Name of the Vulnerable Software and Affected Versions TrustedSite versions prior to 1.2.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update TrustedSite to a version...

PT-2026-84643

Name of the Vulnerable Software and Affected Versions Login With Ajax versions prior to 4.5.2 Description Improper Neutralization of Input During Web Page Generation leads to a Reflected Cross-site Scripting XSS issue. This occurs when an application includes untrusted data in a web page without...

PT-2026-84689

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

PT-2026-84585

Name of the Vulnerable Software and Affected Versions OpenCart versions 4.1.0.3 through 4.1.0.4 Description An issue exists in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Remote manipulation of the address 1 argument allows for cross site scripting,...

PT-2026-84887

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...

PT-2026-84601

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

ALSA-2026:62407 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

CVE-2026-83562: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

PT-2026-84664

Name of the Vulnerable Software and Affected Versions Spark History Server versions prior to 3.5.8 Description Insufficient XSS escaping allows a malicious Spark job to generate arbitrary unescaped frontend code. This can lead to a minimal privilege escalation within the browser. Exploitation...

ALSA-2026:62406 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...