CVE-2026-118391

The elixir-ecto library (versions 3.4.0 to 3.14.2 ) is vulnerable to a memory exhaustion attack due to unbounded query cache growth. When an application interpolates user-provided JSON keys or list lengths into json_extract_path/2, field[^key], or splice/1, Ecto creates a unique entry in an ETS t...

PT-2026-136970

Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into...

CVE-2026-109232

The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-102670

The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-109232 Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX

The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-109232

The Salon Booking System WordPress plugin (versions up to and including 10.31.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'sln[]' parameter. This flaw allows unauthenticated attackers to inject arbitrary...

CVE-2026-109232 Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX

The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-115451

Name of the Vulnerable Software and Affected Versions Salon Booking System – Appointment Booking for Salons, Barbershops & Spas versions prior to 10.32.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a...

WordPress Salon Booking System Cross-Site Script Vulnerability

The WordPress Salon Booking System versions 10.31.9 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the sln parameter. It may lead to storage-based cross-site scripting attacks. Unverified attackers can injec...

WordPress Post Grid Gutenberg Blocks plugin < 5.0.41 - Unauthenticated Custom Field Key Disclosure vulnerability

Unauthenticated Custom Field Key Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin PostX versions 5.0.41...

CVE-2026-86783

The Post Grid Gutenberg Blocks WordPress plugin (versions before 5.0.41 ) contains a vulnerability where it fails to perform proper authorization or post-visibility checks on a specific REST API route. This flaw allows unauthenticated users to disclose the custom field key names of arbitrary post...

CVE-2026-86783 PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including...

PT-2026-97181

Name of the Vulnerable Software and Affected Versions Post Grid Gutenberg Blocks versions prior to 5.0.41 Description An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key...

CVE-2026-93426

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 queryrange API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals,...

CVE-2026-93426 SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 queryrange API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals,...

CVE-2026-93426

SigNoz versions 0.87.0 before 0.142.0 are vulnerable to SQL injection in the v5 query_range API due to unsanitized user-supplied telemetry field-key names. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing...

CVE-2026-85602

CVE-2026-85602 affects the Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 . The plugin selects which reCAPTCHA validation branch to execute based solely on the field key present in the submitted payload. On a site configured for reCAPTCHA v3 , an unauthenticated attacke...

PT-2026-31452

The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insufficient validation of the $name parameter upload field key passed to the generate user file dirpath function, which uses WordPress's path join — a function...