Linux Distros Unpatched Vulnerability : CVE-2026-102330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass we...

CVE-2026-97286: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11...

CVE-2026-62078: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

VulnCheck KEV: CVE-2024-49766

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1778234216)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778234216 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent...

CVE-2026-97287: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5...

PT-2026-103625

Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...

CVE-2026-97298: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...

PT-2026-103042

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

PT-2026-103076

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file upload flaw allows privileged remote attackers to upload and execute web shell backdoors, which can lead to arbitrary code execution on the server. Recommendations At...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1748626479)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748626479 advisory. - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS...

CVE-2026-97270: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...

CVE-2026-97238: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...

CVE-2026-96450: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

CVE-2026-94674: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Pixel Manager for WooCommerce = 1.69.0 versions...

CVE-2026-47096: Improper Neutralization of Input During Web Page Generation

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-103101: Allocation of Resources Without Limits or Throttling

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

CVE-2026-18105: Uncontrolled Resource Consumption

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-102386: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

CVE-2026-102454: Unrestricted Upload of File with Dangerous Type

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...