CVE-2026-76569

Phoca Download extension versions 5.0.0 through 6.1.4 for Joomla contains a reflected XSS flaw in the search GET parameter; attacker-supplied input is reflected unescaped, enabling script execution in a victim's browser. CVSS 4.0 scores it Medium (5.3). No exploitation or patch version is documen...

EUVD-2026-63210

Joomla Extension - phoca.cz - Reflected XSS via pricefrom & priceto filter parameters in Phoca Cart 5.0.0-6.1.7...

CVE-2026-71368

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...

WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Son Bach & Lan Vy HPT Vietnam in WordPress Theme Aora versions = 1.3.19...

CVE-2026-71368

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

CVE-2026-71368

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

CVE-2026-71368

F-RevoCRM contains a stored/reflected XSS flaw; an authenticated user viewing a crafted page may have unintended actions performed on their session. CVSS 3.0 scores 6.1 MEDIUM (network, no privileges, active user interaction). No exploitation or fix details are provided in the documents. Monitor ...

EUVD-2026-63208

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

CVE-2026-76345

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:58+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76334

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:32+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76323

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:07+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76314

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:46+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 22:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmt5dzkjz2y...

CVE-2026-44979 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

EUVD-2026-62937

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

EUVD-2026-62897

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

EUVD-2026-63133

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all...

EUVD-2026-63131

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the brows...

PT-2026-78981

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

PT-2026-78967

Name of the Vulnerable Software and Affected Versions Advance Product Search versions prior to 1.4.9 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by injecting code into a web page...