DbGate JSON Script Runner Code Execution

The vulnerability of the JSON Script Runner component in a cross-platform application for browsing and modifying database data in the DbGate browser is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

PT-2026-67028

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs such as an Author once granted upload access to store a script-bearing file tha...

CVE-2026-13340: Improper Neutralization of Input During Web Page Generation

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs such as an Author once granted upload access to store a script-bearing file tha...

Malicious code in wacve-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071 On import wacveutils, the package's init.py unconditionally invokes checkforupdates, which HTTP-fetches a hardcoded GitHub Gist under the user...

CVE-2026-15385

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-14864

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

CVE-2026-16063 Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

[SECURITY] Fedora 44 Update: gh-2.97.0-2.fc44

A command-line interface to GitHub for use in your terminal or your scripts. gh is a tool designed to enhance your workflow when working with GitHub. It provides a seamless way to interact with GitHub repositories and perform vari ous actions right from the command line, eliminating the need to...

CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

SQLi-Detector-Task

SQLi-Detector-Tas...

CVE-2026-18435

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for...

Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

Attackers modified a JavaScript file served by advertising technology company Adform , turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to...

CVE-2026-15649 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2026-15649

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

EUVD-2026-51759

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11995

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

CVE-2026-16090 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

CVE-2026-15645

Powerkit

CVE-2026-15662 Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15662 Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...