CVE-2026-107657

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-96301

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

multiparty-CVE-2026-8161

CVE-2026-8161 CVE-2026-8161（Multiparty）の概念実証 説明 [email protected] 以前のバージョンは、捕捉されない例外によるサービス拒否（DoS）に対して脆弱です。 パーサーはアップロードされたフィールドとファイルをプレーンな JavaScript オブジェクトに格納し、パーサーが所有するキーと継承されたオブジェクトプロパティを安全に区別しません。巧妙に細工された multipart フィールド名により、パーサーが予期しないプロトタイプチェーン値を読み取り、アップロード処理中にクラッシュする可能性があります。 脆弱なバージョンの...

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

CVE-2026-104956

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956

The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

EUVD-2026-92480

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

PT-2026-106022

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group by and sub group by query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .order byfield...

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

Impact fast-uri's mailto scheme parser compares each query field name to the reserved names to, subject, body while the name is still percent-encoded, and only percent-decodes it when storing it as a generic header. On serialize, the decoded name is re-emitted, so a field name such as %74o...

NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization vulnerability discovered by ? in WordPress Npm fast-uri versions = 4.1.3, 4.1.5...

GHSA-P9H3-GVPQ-5539 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Impact A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 'title' = $field-name and injected into the table header by the bundled...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the AssetPresenter process. An attacker can execute arbitrary scripts in the context of a higher-privileged user's session by injecting maliciou...

CVE-2026-91809 Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...

EUVD-2026-85154

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...

CVE-2026-91809

Foxit PDF Editor/Reader is susceptible to a use-after-free vulnerability during the handling of malformed PDF form fields. The root cause is improper validation during field-name traversal , which can lead the application to access a released object. This vulnerability can result in an applicatio...

CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...