PT-2026-99421

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51 Description Insufficient file type validation in the uacf7 wpcf7 mail components function allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to...

CVE-2026-82901: Unrestricted Upload of File with Dangerous Type

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

CVE-2026-100692: Improper Link Resolution Before File Access

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

profanity-verifier

profanity-verifier Provable check for CVE-2022-40769 : does an EOA's private key lie in the key space reachable by the Profanity vanity-address generator? If yes, the key is recoverable and the account and anything it controls is drainable by anyone. No heuristics. The result is a boolean backed ...

CVE-2026-96756

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

EUVD-2026-85406

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96756

Versions of orval prior to 8.30.0 are susceptible to a code injection vulnerability within the @orval/core factory generator. The root cause is a failure to properly escape date default values in new Date() calls. When the factoryMethods and useDates options are enabled, an attacker can inject ar...

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

ai.koryki.core:koryki-core (>=0.1.0, <=0.2.0), ai.koryki.core:koryki-duckdb (>=0.1.0, <=0.2.0) +2921 more potentially affected by CVE-2026-91777 via tools.jackson.core:jackson-databind (>=3.2.0, <=3.2.2)

tools.jackson.core:jackson-databind MAVEN version =3.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.7.24, =0.7.24, =2.2.0, =2.7.1 and more Source cves: CVE-2026-91777 Source advisory: SNYK:JAVA-TOOLSJACKSONCORE-20059682...

CLEANSTART-2026-HR55516 nanoid is a secure, URL-friendly, unique string ID generator for JavaScript

Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript...

CVE-2026-96756: Improper Control of Generation of Code

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

PT-2026-97409

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.30.0 Description The @orval/core factory generator fails to escape date default values within new Date calls. This allows attackers to inject arbitrary expressions using apostrophes in OpenAPI schema defaults, leading...

Malicious code in @ks-cqc/fingerprint-generator (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16523 Malicious code in @ks-cqc/fingerprint-generator (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-15698

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

EUVD-2025-210971

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-15698 Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Business Name Generator plugin <= 1.3 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Nikhil Gavhane in WordPress Plugin Business Name Generator versions = 1.3...