PT-2026-105060

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match value/3 passes the user-supplied ?name= regular expression to re:run with no match limit option, and executes it once per resource in the result set. OTP's default 10M match limit caps...

PT-2026-97483

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

PT-2026-105053

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is authorized/2 for the /federation-links/.../restart route uses is authorized monitor accepts the monitoring tag, while allowed methods permits DELETE and delete resource/2 triggers rabbit...

PT-2026-97575

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists where the match value/3 function passes a...

SUSE CVE-2026-72792

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected...

CVE-2026-94372

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-94372 Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-94372 Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

EUVD-2026-83900

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-94372

MISP versions below 2.5.47 contain a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page . When the instance detects unknown galaxy clusters during synchronization, it renders sample tag names in an informational notice to site administrators. In the default...

vim: Command injection allows arbitrary code execution via malicious tag files

A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedd...

CVE-2026-94372: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

PT-2026-96122

Name of the Vulnerable Software and Affected Versions Metaphor Creations Ditty ditty-news-ticker versions prior to 3.1.70 Description A stored cross-site scripting issue allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements. This occurs because the...

OESA-2026-3918 qt6-qtconnectivity security update

. Security Fixes: An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.CVE-2026-13326...

OESA-2026-3919 qt6-qtconnectivity security update

. Security Fixes: An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.CVE-2026-13326...

CVE-2026-81653: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

PT-2026-95918

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user performing an action on an image is the owner of the gallery to which the image belongs. This allows users who...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-87917 MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin (versions up to and including 4.14.0 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'data' Dynamic Content Tag , caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts i...