25958 matches found
PT-2026-65318
Name of the Vulnerable Software and Affected Versions Ultimate Addons for Contact Form 7 versions prior to 3.5.46 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...
Denial Of Service (DoS)
pyasn1 is vulnerable to Denial Of Service DoS. The vulnerability is due to the BER decoder parsing long-form tags without limiting the tag identifier size, which allows an attacker to supply crafted ASN.1 input that causes excessive CPU consumption or triggers unhandled exceptions, resulting in a...
MAL-2026-11060 Malicious code in f0-form-manipulator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058782981a80d3fc90af74a840a00cefa0c58b9861c481d0444b7f4f3e6a014b On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir,...
Malicious code in f0-form-manipulator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058782981a80d3fc90af74a840a00cefa0c58b9861c481d0444b7f4f3e6a014b On npm install, the package's preinstall hook executes index.js, which collects host identifiers os.hostname, os.platform, os.arch, os.homedir,...
Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-12143)
Summary IBM Security SOAR uses an older version of the form-data component that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 51.0.10.2 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION:...
GHSA-866W-XMHQ-WJ7X SvelteKit: Prototype pollution in file input deletion path in remote-function forms
If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...
WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.6 - Content Injection vulnerability
Content Injection vulnerability discovered by NosleeP++ in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.6...
CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65901
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65901
DOMPurify 3.4.6 has a cross-site scripting vulnerability in IN_PLACE mode where attacker-controlled nodeName on live non-form nodes can cause scripts to execute when the sanitized tree is inserted into a live document. Attackers can supply hostile live DOM objects with real script children whose ...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
CVE-2026-64815
JetBrains IntelliJ IDEA is affected by CVE-2026-64815 for versions prior to 2026.2. The vulnerability allows arbitrary code injection via UI Designer form files. Root cause details are not provided in the supplied documents, but the weakness enables code execution under certain conditions, as ind...
EUVD-2026-48240
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
CVE-2026-65540
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
EUVD-2026-48141
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
EUVD-2026-48205
Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...
CVE-2026-59517
CVE-2026-59517 concerns the WordPress plugin Easy Form Builder (versions <= 4.0.12). The supplied documents confirm an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting this plugin, with the affected component/version explicitly stated as Easy Form Builder