PT-2026-73108

Name of the Vulnerable Software and Affected Versions Youtube Showcase versions prior to 4.0.5 Description Stored Cross-Site Scripting occurs via the emd mb meta shortcode due to insufficient input sanitization and output escaping on attachment titles. The function EMD MB Helper::image info retur...

PT-2026-73109

Name of the Vulnerable Software and Affected Versions Snippet Shortcodes versions prior to 5.2.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via shortcode...

PT-2026-73081

Name of the Vulnerable Software and Affected Versions Gravity Booster – Styles & Layouts for Gravity Forms versions prior to 5.27 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. Authenticated attackers with...

PT-2026-73077

Name of the Vulnerable Software and Affected Versions Admin Custom Login versions prior to 3.6.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. This allows authenticated attackers with administrator-level...

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

MINI-V38Q-GV5G-63MG

Bulletin has no description...

MINI-6Q69-MHP8-RCX9

Bulletin has no description...

MINI-J6RP-77QJ-R552

Bulletin has no description...

UBUNTU-CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-72397

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core honor vrmversion in pmbusdata2regvid pmbusdata2regvid hardcoded the VR11 encoding regardless of the vrmversion configured by the driver, while pmbusreg2datavid already switched on it. Any driver that selects a...

EUVD-2026-59588

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-74387

Summary of CVE-2026-74387 (Linux kernel, ALSA: seq: midi) : The vulnerability stems from improper synchronization in MIDI event handling. Specifically, event_process_midi() borrows msynth->output_rfile.output and passes the substream to dump_midi() and snd_rawmidi_kernel_write() without coordi...

CVE-2026-74387 ALSA: seq: midi: Serialize output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74293 ASoC: fsl: fsl_audmix: Validate written enum values

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fslaudmix: Validate written enum values fslaudmixputmixclksrc and fslaudmixputoutsrc convert the user-provided enum item with sndsocenumitemtoval before checking whether the item is within the enum's item count. The...

CVE-2026-17090

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' Button Code Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-58864

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16145

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16145

Technical details (affected versions, root cause, impact specifics, remediation) are not publicly available in the provided connected documents. Monitor for updates from official advisories.

CVE-2026-15948

The CVE-2026-15948 entry concerns the Hydra Booking WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the first_name parameter for all versions up to and including 1.2.2 due to insufficient input sanitization and output escaping. The tfhb_host role can be self-assigned via t...