Threat database

The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post at save time because it contains no literal angle bracket characters; the malicious HTML tags are only reconstructed at render time, making this exploitable by Contributors who would ordinarily lack the unfiltered_html capability.

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node_font_family (and any text control serialized into chart_data['settings'])' parameter in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Elementor's Utils::kses_post_deep() does not strip the attack payload on save because the payload contains no disallowed HTML tags — only a single quote and an event-handler fragment — allowing the malicious value to survive persistence.

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is particularly effective against higher-privileged users — such as editors and administrators — who preview a Contributor's pending post containing the malicious shortcode.

INFINITT ULite versions up to 5.0.2.1_BN48_20260528 contain a vulnerability where image-share links are protected by low-entropy passwords without restrictions on repeated authentication attempts. This allows unauthenticated remote attackers to brute-force passwords within the link's validity period and gain unauthorized access to shared medical images. The issue is fixed in version 5.0.2.1_BN50.

CVE-2026-19876 is a reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite versions up to 5.0.2.1_BN48_20260528. It allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of victims who open a crafted link. The vulnerability is due to an unsanitized request parameter that is reflected without proper output encoding. This flaw is fixed in version 5.0.2.1_BN50.

CVE-2026-108018 is a vulnerability in HCLSoftware's BigFix MCM & Mobile product where the admin portal is accessible directly from the internet without VPN or network restrictions. A client-side configuration file publicly exposes non-sensitive environment details, which increases the attack surface and the risk of unauthorized access attempts.

A vulnerability in Microsoft Windows Paint has been addressed by Microsoft. The specific details of the vulnerability are not provided beyond its identification as a security flaw in Windows Paint. No CVSS score or detailed impact information is available.

ARTEX is an open-source autonomous penetration testing framework released in July 2026 that uses large language model (LLM) driven AI agents to automate reconnaissance, exploitation, and data exfiltration with minimal human intervention. As of November 2026, over 1,400 exposed ARTEX consoles are active globally. The framework has been linked to attacks on South Korean financial institutions and a supply chain compromise involving ConnectWise. Operators often expose directories containing exploit binaries and post-exploitation tools. The developer removed the repository after public attribution, but archived copies remain in circulation.

CVE-2026-119516 is a critical deserialization of untrusted data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services. It allows object injection in versions from initial up to 1.0.20. The flaw has a high CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, leading to full confidentiality, integrity, and availability compromise. The issue is fixed in version 1.0.21.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.

Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.

A vulnerability in OpenSSH sshd affects versions older than 10.6p2 on Linux systems using musl libc without PAM. The OpenSSH project has fixed this issue in version 10.6p2.

CVE-2026-65022 is a cross-site scripting (XSS) vulnerability in HCLSoftware BigFix MCM & Mobile versions up to 3.7. The vulnerability arises because the MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. This allows an attacker to inject malicious HTML that can be executed when users view the preview and interact with the crafted content.

HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines. A remote attackercan exhause the CPU with a single request. HTTP::Body version 1.25 limits the size and number of lines in the trailer.

CVE-2026-121824 is a high-severity vulnerability in LY Corporation's Armeria software prior to version 1.43.0. It involves improper handling of malformed Thrift messages that can trigger excessive memory allocation, potentially leading to denial of service conditions.

CVE-2026-121823 is a high-severity vulnerability in LY Corporation's Armeria software prior to version 1.43.0. It involves inconsistent normalization of request paths, which can allow unauthenticated attackers to bypass path-based access controls and access protected resources.

A stored cross-site scripting (XSS) vulnerability exists in LY Corporation's Armeria versions 0.80.0 through 1.42.0. The flaw occurs when directory listing is enabled and attackers control file names, allowing malicious scripts to be stored and executed when a user views the directory listing. This issue is fixed in version 1.43.0.