CVE-2026-42267: Improper Neutralization of Formula Elements in a CSV File

Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLEUSER can create a tag with a formula string as its name e.g. =SUM54+51 via POST /api/tags and assign it to a timesheet. When an admin exports timesheets to XLSX, ArrayFormatter.formatValue joi...

CVE-2026-7650: Improper Neutralization of Input During Web Page Generation

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the e2pdf-download shortcode in all versions up to, and including, 1.32.17. This is due to insufficient input sanitization and output escaping on the shortcode...

evaporation (>=0.1.0, <=1.0.0), hspatial (>=0.1.0, <=2.1.3) +4 more potentially affected by CVE-2026-8088 via gdal (2.4.4)

gdal PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - evaporation =0.1.0, =0.1.0, =0.0.4, =1.0.16, =0.9.0, =0.9.1 Source cves: CVE-2026-8088 Source advisory: OSV:GHSA-J3F5-RW74-G4RV...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8088 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8088 Source advisory: OSV:GHSA-J3F5-RW74-G4RV...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8087 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8087 Source advisory: OSV:GHSA-H9RH-5FFH-H669...

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

Description The Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/noteID/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path...

GHSA-G49P-4QXJ-88V3 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

Description The Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/noteID/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8087 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8087 Source advisory: OSV:PYSEC-2026-2155...

evaporation (>=0.1.0, <=1.0.0), hspatial (>=0.1.0, <=2.1.3) +4 more potentially affected by CVE-2026-8088 via gdal (2.4.4)

gdal PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - evaporation =0.1.0, =0.1.0, =0.0.4, =1.0.16, =0.9.0, =0.9.1 Source cves: CVE-2026-8088 Source advisory: OSV:PYSEC-2026-2156...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8086 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8086 Source advisory: OSV:PYSEC-2026-2154...

evaporation (>=0.1.0, <=1.0.0), hspatial (>=0.1.0, <=2.1.3) +4 more potentially affected by CVE-2026-8086 via gdal (2.4.4)

gdal PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - evaporation =0.1.0, =0.1.0, =0.0.4, =1.0.16, =0.9.0, =0.9.1 Source cves: CVE-2026-8086 Source advisory: OSV:PYSEC-2026-2154...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export vulnerability

Missing Authorization to Authenticated Subscriber+ Scheduled Form Submission Export vulnerability discovered by anhcd05 - VNPT Cyber Immunity in WordPress Plugin Forminator versions = 1.53.0...

CVE-2026-6214

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration,...

EUVD-2026-28308

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration,...

CVE-2026-6214

CVE-2026-6214 affects Forminator Forms for WordPress (≤ 1.53.0). The issue is in listen_for_saving_export_schedule() in library/class-export.php, which fails to perform a capability check before saving a scheduled export configuration, unlike listen_for_csv_export() that verifies permissions. Thi...

CVE-2026-6214 Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration,...

CVE-2026-6214

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration,...

CVE-2026-6222

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the processRequest method in ForminatorAdminModuleEditPage admin/abstracts/class-admin-module-edit-page.php dispatching sensitive module-management actions —...

CVE-2026-6222

CVE-2026-6222 affects the WordPress plugin Forminator Forms (versions

CVE-2026-6222

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the processRequest method in ForminatorAdminModuleEditPage admin/abstracts/class-admin-module-edit-page.php dispatching sensitive module-management actions —...