WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Image Photo Gallery Final Tiles Grid versions = 3.6.12...

CVE-2026-2996

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to and including 1.6.21 . The root cause is a logic flaw in the validate_cart_data function, which allows unauthenticated attackers to bypass required pa...

EUVD-2026-64300

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

CVE-2026-2996 Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

CVE-2026-2996 Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

Exploit for Improper Input Validation in Ui Unifi_Os_Server

UniFi OS CVE Proof of Concept Proof of concept untuk pengujia...

CVE-2026-78003

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

Exploit for CVE-2026-74252

Stored XSS in J2Commerce Guest Checkout via Cookie Filter Bypa...

apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack

A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...

CVE-2026-2996: Improper Input Validation

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

PT-2026-79678

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak exists in the evdev component where the input event structure is allocated on the kernel stack but not fully initialized. On specific architectures, such as SPARC64,...

PT-2026-79550

Name of the Vulnerable Software and Affected Versions Advanced Product Fields Product Addons for WooCommerce versions prior to 1.6.22 Description Improper Input Validation occurs due to a logic flaw in the validate cart data function. This allows unauthenticated attackers to bypass required paid...

PT-2026-79551

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.13 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is...

PT-2026-84280

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier Description The Document.createProcessingInstructiontarget, data function in lib/dom.js accepts an unvalidated target parameter...

PT-2026-79688

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where a user-supplied event type index passed to the 'EVIOCGMASK' and 'EVIOCSMASK' ioctls is used to index the static counts array in the evdev get mask cnt function and...

Linux Distros Unpatched Vulnerability : CVE-2026-74685

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64:...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541

OliveTin , a web interface for executing predefined shell commands, is vulnerable to improper input validation in its executor. The filterToDefinedArgumentsOnly function in service/internal/executor/executor.go contains a special case that allows any user-supplied argument prefixed with ot_ to by...