CVE-2026-2996

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to and including 1.6.21 . The root cause is a logic flaw in the validate_cart_data function, which allows unauthenticated attackers to bypass required pa...

CVE-2026-2996 Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

EUVD-2026-64300

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

PT-2026-79641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the event define fields and update event fields functions. This occurs when one CPU loads a module and executes event define fields while another CPU...

CVE-2026-2996: Improper Input Validation

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

PT-2026-79550

Name of the Vulnerable Software and Affected Versions Advanced Product Fields Product Addons for WooCommerce versions prior to 1.6.22 Description Improper Input Validation occurs due to a logic flaw in the validate cart data function. This allows unauthenticated attackers to bypass required paid...

CVE-2026-53468

Typemill versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). The root cause is missing output encoding , allowing an authenticated user with permission to modify page metadata to inject arbitrary HTML attributes int...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

JLSEC-2026-1353 Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Impact Wasmtime's implementation of the wasi:http/types.fields resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the wasmtime-wasi-http crate is backed by a data structure which panics when it reaches excessive capacity and this...

CVE-2026-74252

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

CVE-2026-74252 Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

CVE-2026-76612

Zoo is a Joomla extension by yootheme.com . Versions prior to 4.1.66 are vulnerable to an unauthenticated stored XSS caused by user-supplied input in comments and user-supplied field elements not being properly escaped. An attacker can inject malicious scripts that execute in the context of other...

CVE-2026-19848

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login an...

CVE-2026-19848 ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login an...

CVE-2026-19848

ProfilePress is a WordPress plugin that, in versions before 4.17.1 , fails to strip shortcodes from two of its profile fields before rendering them on public pages. An unauthenticated attacker can store arbitrary shortcodes in these fields, which are then executed when the page is viewed. The pra...

Malicious code in requests-crypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f971c743a8c6661c9078bdb6486843bb50831fadf9a9a6943e8231fac374ac2f requests-crypt wraps an HTTP client so that every JSON response passes through a DataProcessor that reads a configurable field default 'cos' from the...

CVE-2026-53468: Improper Neutralization of Input During Web Page Generation

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

PT-2026-79380

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...