CVE-2026-93595 ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

CVE-2026-18317 Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-85127

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

CVE-2026-85127 VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

EUVD-2026-82667

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

CVE-2026-85127

The VikBooking Hotel Booking Engine & PMS WordPress plugin, specifically versions 1.8.8 through 1.8.14 , is vulnerable to an unauthenticated stored XSS vulnerability. The flaw exists because the plugin fails to restrict file types or sanitize the contents of files attached by unauthenticated visi...

CVE-2026-85127 VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

CVE-2026-18317: Missing Authorization

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-85127: Improper Neutralization of Input During Web Page Generation

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

PT-2026-95374

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description An access control bypass exists in the query database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to the DatabaseContext, which...

PT-2026-95240

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15 Description Unauthenticated visitors can attach unrestricted file types to the live chat feature. Because the plugin fails to sanitize the contents of these...

CVE-2026-93595: Missing Authorization

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

CVE-2026-78501

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

CVE-2026-78501

CVE-2026-78501 is a command injection vulnerability in Microsoft 365 Copilot's Business Chat , caused by improper neutralization of special elements used in a command. An unauthorized attacker can exploit it over a network to disclose information . The CVSS v3.1 score is 7.4 (HIGH) , with a vecto...

1337x (1.2.5), 8a-scraper (>=0.0.2, <=0.0.4) +667 more potentially affected by CVE-2026-86000 via soupsieve (>=2.0.0, <=2.8.4)

soupsieve PYPI version =2.0.0, =0.0.2, =1.0.4, =0.1.3, =1.0.0, =0.4.0, =1.2.3, =0.2.0, =0.87.2.dev9, =0.24.0, =0.1.0.dev19, =1.3.0, =0.1.0, =1.3.0, =1.3.3 and more Source cves: CVE-2026-86000 Source advisory: OSV:GHSA-GJV8-XP57-G29C...

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

CVE-2026-78501: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

PT-2026-95172

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description Microsoft 365 Copilot's Business Chat contains a command injection flaw, which occurs when special elements used in a command are not properly neutralized. This allows an...

KLA91291 Multiple vulnerabilities in Microsoft Apps

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Microsoft 365 Copilot...