org.jenkinsci.plugins:emailext-template (0.4) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.40.3)

org.jenkins-ci.plugins:email-ext MAVEN version 2.40.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 0.4 Source cves: CVE-2026-48920 Source advisory:...

org.jenkinsci.plugins:emailext-template (>=0.1-beta, <=0.3) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.37.2.2)

org.jenkins-ci.plugins:email-ext MAVEN version 2.37.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template =0.1-beta, =0.3 Source cves: CVE-2026-48920 Source...

org.jenkinsci.plugins:emailext-template (224.va_f6a_ecd5d46e) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1866.v14fa_6d201654)

org.jenkins-ci.plugins:email-ext MAVEN version 1866.v14fa6d201654 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 224.vaf6aecd5d46e Source cves:...

org.jenkinsci.plugins:emailext-template (>=1.0, <=1.1) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.43)

org.jenkins-ci.plugins:email-ext MAVEN version 2.43 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template =1.0, =1.1 Source cves: CVE-2026-48920 Source advisory:...

org.jenkinsci.plugins:emailext-template (249.v81d6ea_f33f2e) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1916.vc954a_f86ff21)

org.jenkins-ci.plugins:email-ext MAVEN version 1916.vc954af86ff21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 249.v81d6eaf33f2e Source cves:...

org.jenkins-ci.plugins:cisco-spark (>=1.1.0, <=1.1.1), org.jenkins-ci.plugins:email-ext-recipients-column (>=1.0, <=72.v546836954562) +2 more potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (>=2.25, <=1916.vc954a_f86ff21)

org.jenkins-ci.plugins:email-ext MAVEN version =2.25, =1.1.0, =1.0, =1.1, =0.1-beta, =249.v81d6eaf33f2e Source cves: CVE-2026-48920 Source advisory: MEND:CVE-2026-48920...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Security issues: CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. CVE-2026-39817: cmd/go: "go tool pack" do...

SUSE-SU-2026:2093-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...

SUSE-SU-2026:2092-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...

WS-2018-0175

In LimeSurvey, versions prior to 2.72.4+171110 are vulnerable against Improper limitation of a pathname to a restricted directory Path Traversal. An attacker could manipulate this vulnerability to edit file from outside of the template directory using the template editor. The function...

Hunting-Bugs

2026 Practical Bug Bounty Guide Built on real-world experie...

web-vulnerabilities-labs

Web Vulnerabilities Labs Notes techniques issues de labs web...

CVE-2026-3001

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the rendercontent method in class-search-result-title.php outputs the val...

CVE-2026-3001

The CWE: CVE-2026-3001 affects the Gutenverse WordPress plugin, up to version 3.4.6. The vulnerability is a Reflected Cross-Site Scripting (XSS) in the search title block: render_content() echoes get_query_var('s') directly into HTML without escaping, enabling an attacker to craft a URL that inje...

Denial of Service (DoS)

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Denial of Service DoS through the renderTemplates function when the for or tablerow tag is used with an empty body. An attacker can...

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

Summary The renderLimit option — documented in docs/source/tutorials/dos.md as the mechanism that "mitigates this by limiting the time consumed by each render call" — can be fully bypassed by a % for % or % tablerow % tag whose body is empty. The per-iteration time check is reached only when the...

Cross-site Scripting (XSS)

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the striphtml filter, which fails to properly remove HTML tags containing newline characters. An attacker...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +167 more potentially affected by CVE-2026-44644 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-44644 Source advisory: SNYK:JS-LIQUIDJS-1688788...

OpenRapid RapidCMS security vulnerability

OpenRapid RapidCMS is a fast, simple, and useful CMS system developed under the OpenRapid open-source framework. Version 1.3.1 of OpenRapid RapidCMS contains a security vulnerability. This vulnerability stems from a flaw in the /template/default/menu.php component, where authentication bypasses a...

PT-2026-44038

Name of the Vulnerable Software and Affected Versions OpenRapid RapidCMS version 1.3.1 Description An authentication bypass exists in the '/template/default/menu.php' endpoint. This issue occurs when a crafted SQL payload is injected into the name cookie parameter, allowing an attacker to...