CVE-2026-82752: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the...

PT-2026-86323

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no results message' node preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86337

Name of the Vulnerable Software and Affected Versions IPGP Visitors Origin WordPress plugin versions prior to 1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS attacks. This occurs when user input is...

PT-2026-86365

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-86307

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wp unslash...

PT-2026-86331

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86428

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the max...

PT-2026-86340

Name of the Vulnerable Software and Affected Versions The Music Store WordPress plugin versions prior to 1.4.5 Description Unauthenticated users can perform a SQL injection because the plugin fails to sanitize and escape user-supplied parameters before incorporating them into a SQL statement. Thi...

PT-2026-86367

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-86324

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

CVE-2026-85787

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

GHSA-M4RF-3FR8-XWX3 vulnerabilities

Vulnerabilities for packages: open-webui, nemo...

GHSA-QX2G-XRX7-VFH8 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787

CVE-2026-85787 affects the SQL validation component of Amazon awslabs postgres-mcp-server (versions before 1.1.7 ). Due to an incomplete list of disallowed inputs , an unauthenticated actor can place crafted SQL into content submitted when an authenticated user interacts with the MCP server, enab...

CVE-2026-53756

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

GHSA-C6MW-8XH8-GPQ6 CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...