CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-15602

CVE-2026-15602 affects the NEX-Forms – Ultimate Forms Plugin for WordPress up to version 9.2.4. The vulnerability is a generic SQL Injection via the additional_params parameter, due to insufficient escaping and poor query preparation. It is a second‑order issue: a payload is stored via the submis...

CVE-2026-15602: Improper Neutralization of Special Elements used in an SQL Command

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2026-73091

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.5 Description This is a second-order SQL Injection issue where an attacker can append additional SQL queries to existing ones to extract sensitive database information. The...

WordPress Import WP plugin < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download vulnerability

Unauthenticated Sensitive Information Exposure via Export File Download vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Import WP versions 2.14.23...

EUVD-2026-58501

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-72850

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-72850

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-72898 vulnerabilities

Vulnerabilities for packages: metabase...

SUSE CVE-2026-9318

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

WeKan expired impersonation records bypass private board export authorization (ImpersonateBleed)

WeKan Expired Impersonation Records Bypass Private Board Export Authorization ImpersonateBleed Vulnerability Overview WeKan administrators can use the impersonation feature to operate as other users, and the system records every impersonation action. The flaw is this: in addition to the normal...

CVE-2026-72850: Improper Limitation of a Pathname to a Restricted Directory

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

Sovereign by Necessity? Frontier AI Export Controls, Cyber Security, and the Limits of National AI Capability

A small number of firms based in two states produce the most capable frontier AI models. The governments of those states have shown both the legal power and the political will to decide which other countries may use these systems. In June 2026 the United States required a leading developer to...

PT-2026-71907

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

Vaulted Passkeys: A Device-Bound Proposal for Authenticated Credential Export and Import

Hardware authenticators deliberately resist private-key extraction, yet replacement, disaster recovery, and controlled migration create a legitimate need for portability. Existing guidance for device-bound credentials commonly reduces recovery risk by registering an additional authenticator befor...

GHSA-2QQV-3JGQ-VPM9 Duplicate Advisory: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h4v5-crx2-3cv4. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowi...

CVE-2026-18171 Docker Sandboxes read-only runtime mount writable through its shared-export alias

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...