287296 matches found
CVE-2026-97286: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11...
PT-2026-103505
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3...
CVE-2026-62078: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...
VulnCheck KEV: CVE-2024-49766
Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...
PT-2026-103087
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course without proper permission,...
Open Interface Service Web Module Privilege Escalation
The vulnerability of the Open Interface Service in the web module of the Siemens Siveillance Control video surveillance and security management software is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to enhance their privileges and...
AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1739387851)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739387851 advisory. - URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects...
PT-2026-103056
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt bb icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...
CVE-2026-97287: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5...
PT-2026-103625
Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...
CVE-2026-97298: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...
AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752087722)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752087722 advisory. - The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS...
PT-2026-103042
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...
PT-2026-103076
Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file upload flaw allows privileged remote attackers to upload and execute web shell backdoors, which can lead to arbitrary code execution on the server. Recommendations At...
PT-2026-103003
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...
CVE-2026-97279: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Polylang = 3.8.9 versions...
CVE-2026-97270: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...
CVE-2026-97238: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...