CVE-2026-93836

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-93836 WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-84310

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-93836 WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-84299

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...

CVE-2026-92969 HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

Day-22--Reflected-Cross-Site-Scripting-XSS-in-HTML-Context

Day 22: Reflected Cross-Site Scripting XSS in HTML Context...

EUVD-2026-84183

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2024-27564

CVE-2024-27564 Описание: Уязвимость в pictureproxy.php позволяет удалённым злоумышленникам выполнять произвольные запросы путём внедрения URL-адресов в параметр url. Эта SSRF-уязвимость может быть использована без аутентификации, что делает её особенно опасной. Уязвимый код находится в файле...

PT-2026-96679

Name of the Vulnerable Software and Affected Versions WPC Product Bundles for WooCommerce versions prior to 8.6.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that...

PT-2026-96665

Name of the Vulnerable Software and Affected Versions WP Table Builder – Drag & Drop Table Builder versions prior to 2.2.2 Description Incorrect Authorization exists due to an operator precedence bug in the post-type guard within the trash table bulk and restore table bulk functions, which preven...

CVE-2026-61685: Improper Neutralization of Special Elements used in an SQL Command

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlalchemy (UTSA-2026-090396)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090396 advisory. SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled. Tenable has extracted the preceding description block directly from the Unity Linux...

The vulnerability in the `src/soupsieve/css_parser.py` script of the Soup Sieve CSS selector library allows a attacker to compromise the accessibility of the protected information.

The vulnerability in the src/soupsieve/cssparser.py script of the Soup Sieve CSS selector library is related to an uncontrolled resource consumption when processing the IDENTIFIER parameter. Exploiting this vulnerability could allow a malicious actor to compromise the accessibility of protected...

PT-2026-96955

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without sanitization or encoding. This occurs within the CallbackHandl...

CVE-2026-15095: Improper Limitation of a Pathname to a Restricted Directory

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

PT-2026-96647

Name of the Vulnerable Software and Affected Versions Contextual Related Posts versions prior to 4.4.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with author-level access and above to perform Stored Cross-Site Scripting. This is achieved by...

CVE-2026-93836: Improper Neutralization of Input During Web Page Generation

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-88020: Improper Neutralization of Input During Web Page Generation

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...