WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...

CVE-2026-65432

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...

CVE-2026-65432 Apache CXF: XXE via WSDL/XSD import parsing

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...

WordPress POUCO Import Users plugin <= 1.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin POUCO Import Users versions = 1.0.0...

CVE-2026-16065

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

MAL-2026-13386 Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

EUVD-2026-53731

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-16065

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-49391: Improper Neutralization of Input During Web Page Generation

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

PT-2026-68625

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.3 Description An injection flaw exists in the CSS scrubber of the software, allowing an unauthenticated remote attacker to inject CSS at-rules, such as importing remote stylesheets, into pages served...

CVE-2026-66684: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-71316

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...

CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

EUVD-2026-53578

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports...

CVE-2026-17624

CVE-2026-17624 affects IBM Langflow OSS 1.0.0–1.10.3. A remote authenticated attacker could execute arbitrary code due to improper validation of module imports. Documented impact is HIGH (CVE base score 8.5). No exploit details are provided in the available sources. No remediation steps are speci...

keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...