Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...

CVE-2026-56096

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

EUVD-2026-65349

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

CVE-2026-56096

CVE-2026-56096 is an information disclosure vulnerability in the "Apache Solr for TYPO3 - Enterprise Search" extension (identifier: solr). The extension passes a user-supplied search query parameter directly to Apache Solr without restricting advanced Solr query syntax such as wildcards, field se...

CVE-2026-56096 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

CVE-2026-56096 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

EUVD-2026-64853

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated...

CVE-2026-13176

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

EUVD-2026-63907

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

CVE-2026-13176

The Eventin WordPress plugin before 4.1.21 contains a blind Server-Side Request Forgery (SSRF) vulnerability. The plugin fails to validate user-supplied webhook URLs stored on events and does not verify event ownership, allowing authenticated users with contributor-level access or above to trigge...

EUVD-2026-63681

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-54508 TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution

TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList and importNaverList in server/src/services/placeService.ts and resolveGoogleMapsUrl in server/src/services/mapsService.ts. The affected sinks call...

CVE-2026-74011

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011 WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011

A Blind SQL Injection vulnerability exists in the InfiniteWP Client WordPress plugin by revmakx, affecting versions through 1.13.9 . The flaw stems from improper neutralization of special elements in SQL commands, allowing an authenticated attacker (high privileges required) to extract data from ...

EUVD-2026-63324

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

EUVD-2026-63256

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/callwebhook.ts issues axios.request with that url, t...