CVE-2026-92409

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

CVE-2026-109901 WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-109901 WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-109901

The Codepeople CP Multi View Event Calendar WordPress plugin is vulnerable to SQL Injection (CWE-89) in versions up to and including 1.4.41 . The root cause is the improper neutralization of special elements used in an SQL command, which could allow an attacker to execute arbitrary SQL queries. T...

EUVD-2026-100895

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin CP Multi View Event Calendar versions = 1.4.41...

Exploit for Cross-site Scripting in Concretecms Concrete_Cms

CVE-2026-18116 Stored XSS via Calendar Event Name to Admin...

Exploit for Cross-site Scripting in Concretecms Concrete_Cms

CVE-2026-18116 Stored XSS via Calendar Event Name to Admin...

CVE-2026-110869: Inefficient Regular Expression Complexity

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...

CVE-2026-109901: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

PT-2026-114183

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.12 Description A regular expression denial of service exists in the SMTPConnection. actionEHLO function. The four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that cause...

PT-2026-113702

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-100404: Missing Authorization

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribe...

PT-2026-113776

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribe...

WS-2026-0156

n8n-nodes-base before 1.121.55, 2.x before 2.43.3 and 2.44.0: the Read/Write Files from Disk and Read Binary Files node evaluates the Files Selector glob on the main event loop with no time limit, so a crafted wildcard pattern blocks the n8n process GHSA-m7gv-mpg5-7c9v...

CVE-2026-101927: Heap-based Buffer Overflow

A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service DoS or achieve privilege escalation to root via crafted IPC event messages...

CVE-2026-98430: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

Linux Distros Unpatched Vulnerability : CVE-2026-110869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain...

Concrete CMS 9.5.2 Calendar Event Name Cross Site Scripting

Concrete CMS versions 8.3.0 through 9.5.2 contain a stored cross site scripting vulnerability in calendar event names that executes when an administrator views a workflow approval notification. https://packetstorm.news/download/235625...

CVE-2026-98430

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...