CVE-2026-96450: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

CVE-2026-94674: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Pixel Manager for WooCommerce = 1.69.0 versions...

CVE-2026-47096: Improper Neutralization of Input During Web Page Generation

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-103101: Allocation of Resources Without Limits or Throttling

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

CVE-2026-18105: Uncontrolled Resource Consumption

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-103050: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-102386: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...

CVE-2026-102384: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in Supreme Modules Lite = 2.5.63 versions...

CVE-2026-102579: Exposure of Private Personal Information to an Unauthorized Actor

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure...

CVE-2026-102454: Unrestricted Upload of File with Dangerous Type

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-102578: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-103445: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS. This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43...

CVE-2026-97298: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1769515411)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769515411 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752087722)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752087722 advisory. - The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS...

PT-2026-103086

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, leading to a SQL Structured Query Language injection. This...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1778234216)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778234216 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1748626479)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748626479 advisory. - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS...

CVE-2026-62078: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

PT-2026-103505

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3...