EUVD-2026-48511

The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widgetsearch' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Chromium: CVE-2026-16422 Insufficient validation of untrusted input in Certificate

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-16415 Insufficient validation of untrusted input in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-16414 Insufficient validation of untrusted input in Chromecast

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-48492

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue...

CVE-2026-12877

Summary : CVE-2026-12877 affects the WordPress plugin “Project Management, Bug and Issue Tracking Plugin” prior to version 5.1.0. Vulnerability : it does not sanitize/escape user input before using it in a SQL query, enabling unauthenticated SQL injection. Impact : high confidentiality and integr...

CVE-2025-9205

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

EUVD-2026-48453

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...

OESA-2026-3133 jbig2dec security update

jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input.CVE-2026-38076...

CVE-2025-9205

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

CVE-2025-9205

CVE-2025-9205 affects MapSVG Lite for WordPress up to version 8.14.0. The issue is a stored XSS vulnerability caused by insufficient input sanitization and output escaping on user-supplied map options attributes. It can be exploited by authenticated attackers with contributor-level access and abo...

EUVD-2025-210507

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

CVE-2026-54120

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...

EUVD-2024-55700

Cal.com calcom/cal.diy versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view e.g., https://app.cal.com/booking/ renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can...

EUVD-2026-48443

Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21395-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21395-1 advisory. This update for trivy fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels...

PT-2026-64259

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The find field function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...

PT-2026-64284

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions prior to 1.10.0 Description Improper input validation in the Mesh Proxy SAR reassembly process can lead to the transmission of corrupted data to the application. This may cause memory pressure and unstable parsing...

PT-2026-64346

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/msm/dsi component where the IO address space on DSI 6G platforms is internally adjusted by io offset. When this adjusted address is used for memory dumping, th...

PT-2026-64271

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...