PT-2026-73901

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.2.0-tuxcare.1...

CVE-2026-14872: Improper Neutralization of Special Elements used in an SQL Command

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

PT-2026-73938

TuxCare rebuilt form-data to address 2 CVEs. Fixed in 1.0.0-rc3-tuxcare.1...

PT-2026-75723

TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.0-tuxcare.2...

PT-2026-75755

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.1.4-tuxcare.2...

PT-2026-75738

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.3.3-tuxcare.5...

PT-2026-75687

TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.1-tuxcare.2...

PT-2026-75054

TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.1-tuxcare.1...

PT-2026-74181

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.0.8-tuxcare.1...

PT-2026-74517

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.0.0-tuxcare.1...

PT-2026-74188

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.3.3-tuxcare.1...

PT-2026-75742

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.1.4-tuxcare.2...

PT-2026-75041

TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.0-tuxcare.1...

PT-2026-75756

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.2.0-tuxcare.2...

PT-2026-75757

TuxCare rebuilt form-data to address 1 CVE. Fixed in 1.0.1-tuxcare.2...

PT-2026-75754

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.0.8-tuxcare.2...

PT-2026-67650

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

Guzzle: Noncanonical cookie domain keeps subdomain scope

Impact SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and...

CVE-2026-69245 Guzzle: Noncanonical cookie domain keeps subdomain scope

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...