PT-2026-85090

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

PT-2026-85116

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

PT-2026-85092

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

PT-2026-85137

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...

PT-2026-85245

Name of the Vulnerable Software and Affected Versions MapLibre GL JS versions prior to 6.4.1 Description The DOM.sanitize function in src/util/dom.ts incorrectly iterates through elem.attributes as a live NamedNodeMap. Because removeAttributes modifies the same collection during iteration, indexe...

ALSA-2026:63124 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME head...

LibreNMS Network Monitoring XSS

The vulnerability of the LibreNMS network monitoring system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS and increase their privileges...

Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME head...

ALSA-2026:63022 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

RHEL 9 : osbuild-composer (RHSA-2026:62803)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62803 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RockyLinux 9 : grafana (RLSA-2026:62406)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62406 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

RHEL 9 : grafana-pcp (RHSA-2026:63136)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:63136 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

PT-2026-85122

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond

Large language models LLMs are becoming integral to web applications and browser agents, transforming online interactions while introducing new attack vectors and reshaping longstanding web vulnerabilities. Classical threats such as cross-site scripting XSS can be amplified through LLM-mediated...

PT-2026-85220

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

PT-2026-85089

Unauthenticated Cross Site Scripting XSS in Under Construction = 5.82 versions...

PT-2026-85087

Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...

CVE-2026-85021: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirecturl causes cross site scripting. The attack is possible to be carried o...

CVE-2026-81776: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-81773: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...