CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

WordPress Royal Addons for Elementor plugin <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting vulnerability

Authenticated Contributor+ Server-Side Request Forgery via Form Builder Widget 'webhookurl' Setting vulnerability discovered by TarPeg007 - Independent Security Researcher in WordPress Plugin Royal Elementor Addons versions = 1.7.1064...

WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Sticky Chat Widget versions = 1.4.2...

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...

PT-2026-77081

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-66646: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-32472: Missing Authorization

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-73187: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-74978: Improper Restriction of Rendered UI Layers or Frames

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74982: Uncontrolled Resource Consumption

Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

PT-2026-77073

Name of the Vulnerable Software and Affected Versions WP Tab Widget versions prior to 1.2.12 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 1.2.11...

PT-2026-77048

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

PT-2026-77015

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A denial-of-service issue exists within the Widget component. Recommendations Update Firefox to...

PT-2026-77011

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A clickjacking issue exists in the Widget component. Clickjacking is a technique where an...

CVE-2026-15623

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...

CVE-2026-15623

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...

EUVD-2026-60060

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...

CVE-2026-15623

CVE-2026-15623 describes an authenticated blind SQL injection in Google Cloud Chronicle SOAR’s legacy dashboard widget API for versions prior to 6.3.85. An authenticated attacker can cause blind SQL queries via a crafted request parameter. The issue is mitigated by the patch in version 6.3.85; no...

CVE-2026-15623 Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service

A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version...