CVE-2026-86794

The Community Events WordPress plugin (versions before 1.6.0 ) is vulnerable to an unauthenticated stored Cross-Site Scripting (XSS) vulnerability. The root cause is a lack of authorisation or nonce checks when processing public event submissions, combined with insufficient output escaping of sub...

CVE-2021-32644

CVE-2021-32644 This vulnerability is an XSS vulnerability that affected versions prior to Ampache 4.4.3. https://nvd.nist.gov/vuln/detail/CVE-2021-32644 Installation and Execution Steps 1. Install Ampache When installing, please configure port forwarding in the docker-compose.yml file. The...

Royal-Event-Management-System-todate-SQL-Injection-Authenticated

Royal Event Management System - 'todate' SQL Injection Authenticated 1. Description: Royal Event Management System 1.0 allows SQL Injection via parameter 'todate' in /royalevent/btndatesreport.php?= Exploiting this issue could allow an attacker to compromise the application, access or modify data...

PT-2026-132771

Name of the Vulnerable Software and Affected Versions joi versions 17.1.1 through 17.13.8 joi versions 18.0.0 through 18.3.0 Description The Joi.string.email multiple: true rule uses a separator regular expression that causes quadratic work during String.prototype.split when processing long...

CVE-2026-119202: hapijs content: @hapi/content provides HTTP Content-* header parsing

@hapi/content provides HTTP Content- header parsing. From 3.0.6 until 6.0.3, Content.disposition uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token...

CVE-2026-107045

The Citrine application (v3.1.0, versionCode 62) contains a vulnerability in the CitrineContentProvider component due to insecure permissions . This flaw allows an unauthorized attacker to arbitrarily read another user's Nostr event database . No specific remediation or exploit details are provid...

EUVD-2026-113268

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 versionCode 62 allows unauthorized attackers to arbitrarily read another's Nostr event database...

GHSA-R4J5-9XPP-3985 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

EUVD-2026-110077

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks...

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

EUVD-2026-110367

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS...

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS vulnerability discovered by ? in WordPress npm seroval versions = 1.6.7...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

EUVD-2026-109185

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service...

Cross-site Scripting (XSS)

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the breadcrumbs.style option, which is passed to SVGElement.attr rather than applied as CSS. An...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

GHSA-35RR-XWFH-X789 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Impact The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live...

npm: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

npm: Highcharts Core: breadcrumbs.style keys become SVG event-handler attributes vulnerability discovered by ? in WordPress npm highcharts versions = 10.0.0, 11.4.9...