1136239 matches found
PT-2026-50182
Name of the Vulnerable Software and Affected Versions @mariozechner/pi-coding-agent versions 0.27.5 through 0.73.1 @earendil-works/pi-coding-agent versions 0.74.0 through 0.78.0 Description Pi HTML exports render session Markdown into a static HTML file but fail to consistently reject unsafe...
PT-2026-50156
Name of the Vulnerable Software and Affected Versions Hugo versions prior to 0.162.0 Description Hugo accepts content files in various markup formats. Files mapped to the text/html media type, such as .html files located under /content or pages generated by a content adapter where content.mediaTy...
PT-2026-49825
Name of the Vulnerable Software and Affected Versions PowerSchool Employee Access Center version 23.10 Description Improper Neutralization of Input During Web Page Generation allows Cross-Site Scripting XSS, a flaw where malicious scripts are injected into otherwise trusted websites. An attacker...
RHEL 9 : redis:7 (RHSA-2026:26306)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:26306 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...
PT-2026-50100
Unauthenticated Cross Site Scripting XSS in MagOne = 9.0 versions...
PT-2026-49758
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12 Description Exported session HTML preserves unsafe javascript: and data: links in generated content. This allows for the execution of browser-side scripts if a trusted operator opens the exported file and...
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs, webhooks, monitoring, JavaScript execution, and configuration...
CVE-2026-48157
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle and/or setDescription to include untrusted/request-derived data in the error title or description e.g. "No products found...
EUVD-2026-36979
Unauthenticated Cross Site Scripting XSS in Coupon Affiliates = 7.5.3 versions...
EUVD-2026-36990
Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.0.0 versions...
EUVD-2026-36994
Unauthenticated Cross Site Scripting XSS in WP Time Slots Booking Form = 1.2.46 versions...
EUVD-2026-36964
Subscriber Cross Site Scripting XSS in Shipment Tracker for Woocommerce = 1.5.3.2 versions...
EUVD-2026-36972
Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...
EUVD-2026-36930
Unauthenticated Cross Site Scripting XSS in WP Google Review Slider = 18.0 versions...
EUVD-2026-36949
Unauthenticated Cross Site Scripting XSS in Social Slider Feed = 2.3.2 versions...
EUVD-2026-36927
Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.10.6 versions...
EUVD-2026-36931
Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...
EUVD-2026-36942
Subscriber Cross Site Scripting XSS in JupiterX Core = 4.14.1 versions...