CVE-2026-102424: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

CVE-2026-102830: Improper Neutralization of Input During Web Page Generation

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

PT-2026-102705

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description The final form submission processes JSON arrays for each upload field but only verifies that IDs are numeric. Because client-supplied filenames and display names are trusted directly, the...

PT-2026-102708

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description An unauthenticated remote code execution RCE issue exists in the com baforms component. The software allows administrators to define PHP code that executes after a public form submission, whi...

CVE-2026-102425: Improper Control of Generation of Code

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ashish Agarwal @Donrulezz in WordPress Plugin GravityExport Lite for Gravity Forms versions = 2.7.2...

PT-2026-99812

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi products affected versions not specified Description BUFFALO Wi-Fi products improperly handle input from web forms when assembling internal command line strings. This allows an administrative user to execute arbitrary operating...

PT-2026-99243

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12 Description The plugin fails to perform a capability check on the AJAX handler used to save review submission forms. Additionally, the nonce a unique token used to prevent replay attacks is...

CVE-2026-85293

The self-hosted open source application InvoicePlane is vulnerable to Stored Cross-Site Scripting (XSS) in version 1.7.2-beta-1 . The root cause is the failure to enforce email syntax on client_email values, which are then rendered unescaped within double-quoted attributes in the invoice mailer a...

CVE-2026-85293 InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores clientemail values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote...

WordPress Repeater Fields for Elementor Forms plugin <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin Repeater Fields for Elementor Forms versions = 2.2.7...

CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-89426

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

CVE-2026-94573 Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-94573 Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-86579

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

EUVD-2026-86578

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

CVE-2026-89426

The Knit Pay WordPress plugin (versions up to and including 9.6.1.0 ) is vulnerable to Privilege Escalation . The root cause is the maybe_update_user_role() function, which reads a target role directly from an attacker-controlled Gravity Forms entry field (via user_role_field_id) and passes it to...