PT-2026-79449

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 1.3.4 Description The hydra.utils.instantiate function resolves and calls Python objects selected by configuration through the resolve target function in hydra/ internal/instantiate/ instantiate2.py. This allows...

PT-2026-80203

Summary hydra.utils.instantiate resolves and calls Python objects from config. If an application passes untrusted config to instantiate, an attacker who controls target and its arguments can cause arbitrary code execution in the consuming process. Hydra is not a network service. Exploitation...

CVE-2026-68508: Improper Control of Generation of Code

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...

WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability

Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...

CVE-2026-15948

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15948

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15948

The CVE-2026-15948 entry concerns the Hydra Booking WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the first_name parameter for all versions up to and including 1.2.2 due to insufficient input sanitization and output escaping. The tfhb_host role can be self-assigned via t...

EUVD-2026-58861

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15948: Improper Neutralization of Input During Web Page Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-72152

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web...

GO-2026-4807 vulnerabilities

Vulnerabilities for packages: hydra-fips, hydra...

GO-2025-3987 vulnerabilities

Vulnerabilities for packages: weaviate, hydra-fips, hydra...

GO-2026-5027 vulnerabilities

Vulnerabilities for packages: vault, knative-operator-fips, knative-eventing-fips, crossplane-provider-aws-elasticache, traefik, step, eks-distro, etcd-fips, prometheus-fips, gotrue, falco-no-driver, crossplane-provider-azure-streamanalytics, knative-eventing, harbor, terraform-provider-acme,...

GO-2026-5028 vulnerabilities

Vulnerabilities for packages: vault, knative-operator-fips, knative-eventing-fips, crossplane-provider-aws-elasticache, traefik, step, eks-distro, etcd-fips, prometheus-fips, gotrue, falco-no-driver, crossplane-provider-azure-streamanalytics, knative-eventing, harbor, terraform-provider-acme,...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: vault, knative-operator-fips, knative-eventing-fips, crossplane-provider-aws-elasticache, traefik, step, eks-distro, etcd-fips, prometheus-fips, gotrue, falco-no-driver, crossplane-provider-azure-streamanalytics, knative-eventing, harbor, terraform-provider-acme,...

GO-2026-4807 vulnerabilities

Vulnerabilities for packages: hydra...

GO-2025-3987 vulnerabilities

Vulnerabilities for packages: weaviate, hydra...

GO-2026-5025 vulnerabilities

Vulnerabilities for packages: karpenter, prometheus-operator, kine, caddy, telegraf, hubble, traefik, kubernetes-dashboard, istio, step-issuer, falco-no-driver, ingress-nginx-controller, crossplane-provider-azure-authorization, k3s, grafana-pyroscope, kubernetes, helm, flux, prometheus, glab, val...