PT-2026-76434

These are all security issues fixed in the pgadmin4-9.17-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-71593

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

PT-2026-71563

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

PT-2026-71527

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28004: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...

PT-2026-71604

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

PT-2026-71592

Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...

PT-2026-71574

Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...

CVE-2026-61960: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-66471: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

PT-2026-71576

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

PT-2026-71540

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

PT-2026-71548

Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...

PT-2026-71536

Unauthenticated Cross Site Scripting XSS in GeekyBot = 1.2.6 versions...

CVE-2026-73357: Improper Neutralization of Input During Web Page Generation

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

PT-2026-71587

Customer Cross Site Scripting XSS in WpBookingly = 1.3.2 versions...

Cross-site Scripting (XSS)

Overview @jupyterlab/imageviewer is a JupyterLab - Image Widget Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ImageViewer. An attacker can execute arbitrary code on the server by tricking a user into opening a specially crafted SVG image in the image viewer...

DEBIAN-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73427

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

UBUNTU-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...