CVE-2026-2502

The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header. This is due to the plugin trusting and logging attacker-controlled IP header data and rendering debug log entries without outp...

PT-2026-20947

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ Web Site Management Server allows Stored XSS. The vulnerability could execute malicious scripts on the client side when the download query parameter is removed from the file URL,...

PT-2026-20859

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in GIMP’s parsing of XWD files, leading to a potential out-of-bounds write. This can allow a remote attacker to execute arbitrary code on systems running affected versions of GIMP...

CVE-2026-23861

Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML o...

Improper Authentication

Overview @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Improper Authentication in resolveProvider for Ngrok webhooks. An attacker can cause unauthorized webhook requests to be accepted by supplying malicious headers, including Forwarded ...

CVE-2026-26357

Dell Unisphere for PowerMax, versions 9.2.4.x, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or...

CVE-2025-36425 IBM Db2 Information Disclosure

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration...

rgw: RGW DoS attack with empty HTTP header in S3 object copy

A flaw was found in Ceph RGW. Using the x-amz-copy-source header to upload an empty object will cause Ceph RGW to crash, leading to availability issues...

PT-2026-20313

Name of the Vulnerable Software and Affected Versions Dell Unisphere for PowerMax vApp versions 9.2.4.x Description The software contains an Improper Neutralization of Input During Web Page Generation issue, also known as Cross-site Scripting. A low privileged attacker with remote access could...

Dell Unisphere for PowerMax 跨站脚本漏洞

Dell Unisphere for PowerMax is a graphical management platform developed by the American company Dell. The version 9.2.4.x of Dell Unisphere for PowerMax contains a cross-site scripting vulnerability, which arises from improper input handling and may lead to cross-site scripting attacks...

CVE-2025-27243

Out-of-bounds write in the firmware for some IntelR Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result m...

CVE-2025-14573

Mattermost versions 10.11.x = 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561...

CVE-2025-14573

Mattermost versions 10.11.x = 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561...

📄 JUNG Smart Visu Server Cache Poisoning

Python proof of concept web cache poisoning exploit for JUNG Smart Visu Server that builds on the finding from LiquidWorm. ============================================================================================================================================= | Title : JUNG Smart Visu Server...

CVE-2026-23190 ASoC: amd: fix memory leak in acp3x pdm dma ops

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: fix memory leak in acp3x pdm dma ops...

CVE-2026-23165

In the Linux kernel, the following vulnerability has been resolved: sfc: fix deadlock in RSS config read Since cited commit, core locks the netdevice's rsslock when handling ethtool -x command, so driver's implementation should not lock it again. Remove the latter...

CVE-2026-23165

CVE-2026-23165 affects the Linux kernel sfc (Solarflare) network driver. The issue is a deadlock when reading RSS config with ethtool -x because the driver locks the net_device rss_lock that is already held by the core; the fix is to remove the driver-side lock acquisition (deadlock avoidance). P...

CVE-2026-24853 Caido has an insufficient patch for DNS rebind leading to RCE

Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This...

CVE-2026-1320

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-8042

Name of the Vulnerable Software and Affected Versions Caido versions prior to 0.55.0 Description Caido is a web security auditing toolkit. Before version 0.55.0, the software blocked connections from non-whitelisted domains attempting to reach the 8080 port, displaying a message indicating the...