CVE-2026-14819 Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-14819

CVE-2026-14819 affects the WordPress plugin Event Tickets and Registration (prior to version 5.28.4). The issue is an improper escape of event titles in the ticket history log, enabling a Stored XSS attack that can execute in higher-privileged contexts on multisite installations. The vulnerabilit...

EUVD-2026-49699

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-14819

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-65447

creationtimestamp| type| source ---|---|--- 2026-07-28 00:26:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mro5lgmkep24...

PT-2026-65391

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

PT-2026-65474

The EVTCHNOP expand array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP reset, resulting in dereferencing a NULL pointer...

CVE-2017-7322

creationtimestamp| type| source ---|---|--- 2026-07-27 21:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrnu537s4a2y...

CVE-2026-59239

creationtimestamp| type| source ---|---|--- 2026-07-27 21:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrntd4xjjg2i...

CVE-2026-42017

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

EUVD-2026-49568

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-42017

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-42017 Privilege escalation via JFrog Worker event token exposure

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383

The CVE-2026-12383 entry describes a flaw in the Event-Driven Ansible (EDA) server where ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny] , authentication_classes=[] ), relying solely on the Subject header for mTLS authentication and not validating that th...

CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

EUVD-2026-49406

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...