EUVD-2026-1516

Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields Explain the Complaint submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer /admin/complaint-details.php?cid=. When an administrator opens the complaint, injected...

EUVD-2026-1429

Cross-Site Scripting XSS is present on the LoginID parameter on the /PSP/app/web/reg/regdisplay.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34. Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allows attackers to...

CVE-2026-21694 Titra APIs have Improper Access Control

Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50...

CVE-2026-21685

creationtimestamp| type| source ---|---|--- 2026-01-07 23:09:50+00:00| seen| Telegram/Hv7piurWFmTJB7c7iHri9T0M-meMIfk5qPkk7ikOJpSuKtA 2026-01-07 23:25:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbumiikxtr2e...

EUVD-2026-1170

Bio-Formats versions up to and including 8.3.0 contain an XML External Entity XXE vulnerability in the Leica Microsystems metadata parsing component e.g., XLEF. The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity...

EUVD-2026-1167

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting XSS.This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39...

EUVD-2026-1210

Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K...

EUVD-2026-1194

An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured unencrypted MQTT communications protocol, write on the server topics of the board that controls the MQTT communications...

EUVD-2026-1305

The Easy GitHub Gist Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the gist shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-1334

The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'init' action in all versions up to, and including, 3.4.9. This makes it possible for unauthenticated attackers to delete specific plugin options via the 'unifyplugindowngrad...

EUVD-2026-1281

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/fileid REST API endpoint. This is due to a parameter mismatch between the DELETE operation and authorization check, where the...

EUVD-2026-1237

The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'checkipaymuresponse' function. This is due to the plugin not validating webhook request authenticity through signature verification or origi...

EUVD-2026-0998

Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags...

EUVD-2026-1061

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘islinking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-21746

creationtimestamp| type| source ---|---|--- 2026-01-06 07:16:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbqftkdjti2y...

EUVD-2026-1082

Not used...

EUVD-2026-1092

Not used...

EUVD-2026-1081

The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-0582

creationtimestamp| type| source ---|---|--- 2026-01-05 10:02:34+00:00| published-proof-of-concept| Telegram/UCM3N0VAiIL0X9q05DMaRnnlz6r5GWtUQVOA9u8gPZf080...

CVE-2026-21483

creationtimestamp| type| source ---|---|--- 2026-01-02 18:50:43+00:00| published-proof-of-concept| https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565 2026-01-24 22:43:18+00:00| seen| https://gist.github.com/alon710/0ae3438b83af1f6dc50fe382f034b3e9 2026-01-24 22:43:21+00:00|...