The Bold Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'background_image' parameter of the bt_bb_section shortcode. This affects all versions up to and including 5.7.2. Authenticated users with Contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.
A NULL pointer dereference vulnerability in Pgpool-II can cause the watchdog process to terminate abnormally. This issue can be triggered by an unauthenticated attacker, potentially leading to denial of service. No patch information is currently provided.
The Bold Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the title attribute of the bt_bb_service shortcode. This affects all versions up to and including 5.7.2. Authenticated users with Contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes.
CVE-2026-92869 is an out-of-bounds write vulnerability in Pgpool-II that may allow an authenticated attacker to cause abnormal process termination. This vulnerability does not impact confidentiality or integrity but can disrupt availability by crashing the process.
The Bold Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'target' parameter of the bt_bb_icon shortcode. This affects all versions up to and including 5.7.2. The flaw allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
The Bold Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'images' parameter of its bt_bb_css_image_grid shortcode. This vulnerability affects all versions up to and including 5.7.2. It allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
A vulnerability in Liquid Web / StellarWP GiveWP plugin allows authentication bypass due to improper validation of unsafe equivalence in input. This affects GiveWP versions up to and including 4.16.9. The flaw can be exploited remotely without privileges or user interaction, leading to full confidentiality and integrity compromise but no availability impact.
Apache PLC4X versions from 0.9.0 up to but not including 1.0.0 contain improper verification of cryptographic signatures and improper certificate validation in the OPC UA driver. This flaw allows an attacker positioned between client and server to impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials. The vulnerability manifests differently across versions, including logging but not enforcing failed signature checks, inverted signature validation logic, acceptance of untrusted server certificates, and defaulting to weak security policies. Version 1.0.0 fixes these issues by correctly verifying signatures, enforcing certificate trust, and requiring stronger security policies.
The npm package 'reactjs-risk' versions 99.17.1 and 99.17.2 contains malicious code that executes during installation. Its preinstall script collects host identity metadata including hostname, username, and platform, encodes this data, and sends it via DNS lookup to a third-party domain without user consent. The package's main entry point is a non-functional stub, indicating the sole purpose is to exfiltrate installer information. This behavior is deliberately obfuscated to evade detection.
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
Red Hat has issued a security advisory for a vulnerability identified as CVE-2026-102278 affecting the Red Hat Hardened Images RPMs, specifically multiple nodejs26 packages. The update addresses a CWE-770 weakness and updates nodejs26 and related components to version 26.10.0-0.2.hum1 across various architectures. No detailed technical information or exploitation methods are provided. Users are advised to apply the update through official Red Hat channels.
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.