CVE-2026-40176

CVE-2026-40176 — Composer Perforce ドライバーコマンドインジェクション（概念実証） Composer の Perforce リポジトリドライバーにおけるコマンドインジェクションの脆弱性を実証し、差分検証 する自己完結型のOOPスタイルPHP概念実証（PoC）です。 このPoCは、同じ悪意のある composer.json を2つのComposerバイナリ（影響を受ける リリース 2.9.5 と 修正済み リリース...

CVE-2018-17463

CVE-2018-17463 CVE-2018-17463 の実用的な概念実証エクスプロイト。WebAssembly RWX Pages を利用した Shellcode 実行。 CVE-2018-17463 は、Google Chrome 70.0.3538.64 より前のバージョンの V8 における誤った副作用アノテーションに起因し、細工された HTML ページを介してリモートの攻撃者がサンドボックス内で任意のコードを実行することを可能にします。 この Proof of Concept は、以下のブログ記事に直接関連しています。 Chrome Browser Exploitation,...

CVE-2026-96755

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-91073

The Subscribe Forms WordPress plugin (versions 1.4.1-1.6.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape specific form settings before they are outputted on a page. This allows authenticated users with the Author role ...

CVE-2026-19226 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

EUVD-2026-60928

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66644

WordPress Typing Effect plugin (versions

WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...

PT-2026-77071

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66644: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-16992

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it...

EUVD-2026-54876

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...

CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...