CVE-2026-94154 Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter

The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

EUVD-2026-93507

Payload external upload trust validation issue...

EUVD-2026-92760

Ghost: Stored XSS via oEmbed Photo Responses...

EUVD-2026-94015

Backstage: Improper input validation in cloud storage URL readers...

GHSA-7649-WM97-W3J3 Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

GHSA-QGVJ-QCF8-XQ73 Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

EUVD-2026-94056

Backstage: Improper URL validation in catalog entity placeholder resolution...

Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

USN-8897-1 lxml vulnerabilities

Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A remote attacker could possibly use this issue to bypass URL sanitization, leading to a cross-site scripting attack. CVE-2026-49825 Qiu Sihao discovered that lxml incorrectly handled untrusted XML input. A remote...

USN-8897-1: lxml vulnerabilities

Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A remote attacker could possibly use this issue to bypass URL sanitization, leading to a cross-site scripting attack. CVE-2026-49825 Qiu Sihao discovered that lxml incorrectly handled untrusted XML input. A remote...

BIT-JOOMLA-2026-92222 Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260909 - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors...

Important: Red Hat Security Advisory: Release of components for Service Telemetry Framework 1.5.7

Release of components for the Service Telemetry Framework Service Telemetry Framework STF provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat...

CVE-2026-97354

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

EUVD-2026-94192

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

CVE-2026-97354

The PowerPress Podcasting plugin by Blubrry for WordPress (versions 11.13.12 - 11.17.10 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a failure to validate the destination of redirects when the plugin fetches a user-supplied media URL. This allows users with contributo...

CVE-2026-97354 PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

CVE-2026-97354 PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

EUVD-2026-94188

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-106498

A flaw was found in @backstage/plugin-catalog-backend. An authenticated remote user can craft a catalog entity containing placeholder directives that reference resources outside the entity's source repository due to improper URL validation. Under certain configurations, this can lead to informati...

CVE-2026-106494

A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...