CVE-2026-97279: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Polylang = 3.8.9 versions...

CVE-2026-97262: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...

CVE-2026-96819: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in oik = 4.15.4 versions...

CVE-2026-96450: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

CVE-2026-94674: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Pixel Manager for WooCommerce = 1.69.0 versions...

CVE-2026-102579: Exposure of Private Personal Information to an Unauthorized Actor

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure...

CVE-2026-97287: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5...

CVE-2026-97286: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11...

CVE-2026-97270: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...

CVE-2026-102578: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102454: Unrestricted Upload of File with Dangerous Type

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2026-103625

Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...

PT-2026-103276

Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server LSWS versions prior to 6.3.7 build 1 Description LiteSpeed Web Server LSWS mishandles internal redirect URL validation in a specific corner case. This issue involves double decoding of the same data, which can lead to...

PT-2026-103042

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

PT-2026-103086

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, leading to a SQL Structured Query Language injection. This...

PT-2026-103056

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt bb icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...

PT-2026-103076

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file upload flaw allows privileged remote attackers to upload and execute web shell backdoors, which can lead to arbitrary code execution on the server. Recommendations At...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1748626479)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748626479 advisory. - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS...

PT-2026-103026

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

PT-2026-103003

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...