CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

EEF-CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments

Summary Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a...

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin, in versions prior to 7.6.1 , is vulnerable to SQL injection . The root cause is the improper sanitization and escaping of product-feed custom filter rules before they are utilized in a SQL query. This flaw allows users with the Contributo...

WordPress Product Feed Manager For WooCommerce plugin < 7.6.1 - Contributor+ SQL Injection vulnerability

Contributor+ SQL Injection vulnerability discovered by Md Amin Ullah Sheikh in WordPress Plugin Product Feed Manager versions 7.6.1...

CVE-2026-15258 Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2026-15258 Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

EUVD-2026-51427

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2026-57232: Server-Side Request Forgery (SSRF)

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-15258: Improper Neutralization of Special Elements used in an SQL Command

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

PT-2026-66716

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

PT-2026-66757

Name of the Vulnerable Software and Affected Versions ufirstgroup ymlr versions 0.0.1 through 5.1.5 Description Improper neutralization of CRLF Carriage Return Line Feed sequences in the Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents via document...

PT-2026-66837

Name of the Vulnerable Software and Affected Versions Contao versions 5.3.35 through 5.3.47 Contao versions 5.7.0-RC1 through 5.7.8 Description The Feed Reader front-end module fails to validate the scheme or private addresses of configured RSS feed URLs. This occurs because the getResponse...

SUSE CVE-2026-35601

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar propert...

SUSE CVE-2026-40885

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and th...

CVE-2026-64785

A flaw was found in SwiftNIO HTTP/2. This vulnerability allows a remote attacker to perform HTTP request smuggling or response splitting. The issue stems from insufficient validation of incoming HTTP/2 HEADERS frames, which are parts of an HTTP/2 request. This allows special control characters,...

undici: undici: HTTP header injection via unvalidated blob-like body type property

A flaw was found in undici. An application that processes a hand-rolled blob-like request body with a type property derived from untrusted input may allow a remote attacker to inject Carriage Return Line Feed CRLF sequences. This vulnerability enables the attacker to append arbitrary HTTP headers...