EUVD-2026-102551

A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.getmodelmeta.custommetadatamap of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument...

EUVD-2026-102550

A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.getmodelmeta.custommetadatamap of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the...

CVE-2026-111212: Improper Neutralization of Directives in Dynamically Evaluated Code

A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.getmodelmeta.custommetadatamap of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the...

CVE-2026-111237: Improper Neutralization of Directives in Dynamically Evaluated Code

A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.getmodelmeta.custommetadatamap of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument...

CVE-2026-110375 WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...

CVE-2026-106604 WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0...

CVE-2026-110890

The Crocoblock JetSmartFilters WordPress plugin (versions n/a through 3.8.6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to the Improper Neutralization of Input During Web Page Generation . An attacker can exploit this to execute malicious scripts in the context of a user's bro...

EUVD-2026-102046

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31...

CVE-2026-108491

The Everest Forms WordPress plugin (versions

CVE-2026-108498 WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1...

CVE-2026-108491 WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...

CVE-2026-76182: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...

CVE-2026-104828: Improper Neutralization of Input During Web Page Generation

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...

PT-2026-114924

Name of the Vulnerable Software and Affected Versions maxfoundry Social Share Buttons versions prior to 1.32 Description An issue exists in the share-button component where improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS. Stored XSS occurs wh...

GitLab 19.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-96893)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticat...

CVE-2026-103846

Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation o...

CVE-2026-108487

The Hossni Mubarak Books Gallery (wp-books-gallery) WordPress plugin, versions up to and including 4.8.4 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject ...

CVE-2026-108490

The LeapWorx Premium Addons for Elementor WordPress plugin (versions n/a through 4.11.110 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts tha...

CVE-2026-108495

The SureForms WordPress plugin (versions n/a through 2.12.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored on the server and subsequently exe...

CVE-2026-54870

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...