DNN Cross-Site Scripting Vulnerabilities

DNN also known as DotNetNuke is an open-source content management system CMS developed by the American company DNN, supported by Microsoft and based on the ASP.NET platform. This system features easy installation, scalability, and rich functionality. Versions of DNN prior to 9.13.10 and 10.2.0...

CVE-2026-24838

CVE-2026-24838 affects DotNetNuke (DNN) where the module title’s richtext can execute scripts, enabling a stored XSS condition. Affected versions are prior to 9.13.10 and 10.2.0; versions 9.13.10 and 10.2.0 contain a fix. The issue is triggered via the module title field and could execute in cert...

EUVD-2026-4864

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module operations in the Persona Bar. Versions 9.13....

CVE-2026-24837 DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module operations in the Persona Bar. Versions 9.13....

@almadar/orb (18.0.1), @auriclabs/sst-types (>=0.0.1, <=0.1.0) +16 more potentially affected by CVE-2026-24910 via bun (>=1.0.2, <=1.3.2)

bun NPM version =1.0.2, =0.0.1, =1.0.57, =0.1.0, =8.0.4, =1.0.0, =0.0.0, =1.2.27, =1.2.21, =0.0.2, =0.0.33, =0.1.3, =0.0.19-beta.11, =0.0.19-beta.20 and more Source cves: CVE-2026-24910 Source advisory: SNYK:JS-BUN-15123966...

GHSA-VVJ3-C3RP-C85P PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Overview A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious...

CVE-2026-24778 Ghost vulnerable to XSS via malicious Portal preview links

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially...

CVE-2026-24688 pypdf has possible Infinite Loop when processing outlines/bookmarks

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +356 more potentially affected by CVE-2026-24473 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.8.0 and more Source cves: CVE-2026-24473 Source advisory: SNYK:JS-HONO-15123868...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +356 more potentially affected by CVE-2026-24473 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.8.0 and more Source cves: CVE-2026-24473 Source advisory: OSV:GHSA-W332-Q679-J88P...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +356 more potentially affected by CVE-2026-24472 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.8.0 and more Source cves: CVE-2026-24472 Source advisory: OSV:GHSA-6WQW-2P9W-4VW4...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +356 more potentially affected by CVE-2026-24398 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.8.0 and more Source cves: CVE-2026-24398 Source advisory: OSV:GHSA-R354-F388-2FHH...

CVE-2020-36977 Wondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service Path

Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious code. Attackers can exploit the unquoted path to replace the service binary with a malicious executable, enabling...

EUVD-2020-30874

EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploiting the service binary path. Attackers can leverage the unquoted path in 'C:\Program Files\Common Files\EPSON\EPW!3SSRP\ES60RPB.EXE' to...

CVE-2026-23892

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a theoretical timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the firs...

CVE-2026-0746

CVE-2026-0746 : The WordPress AI Engine plugin (

CVE-2026-1480 Out-of-band SQL injection in Quatuor Performance Evaluation

An out-of-band SQL injection vulnerability OOB SQLi has been detected in the Performance Evaluation EDD application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Idusuario' in '/evaluacionobjetivosanyosigevalua.aspx', could allow an attacker to...

EUVD-2026-4749

An out-of-band SQL injection vulnerability OOB SQLi has been detected in the Performance Evaluation EDD application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Idusuario' and 'Idevaluacion’ in ‘/evaluacioncompetenciasevaluaold.aspx’, could allow ...

AZL-75348 CVE-2026-22796 affecting package openssl 1.1.1k-38

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...

AZL-75299 CVE-2026-22796 affecting package openssl for versions less than 3.3.5-3

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...