CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-93601

rustls-webpki (the Rust webpki fork used by rustls) versions ≥ 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly evaluated permitted-subtree DNS name constraints for wildcard certificates. For example, a name constraint of accept.example.com was treated as satisfied by a certificate f...

CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

EUVD-2026-82896

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

EUVD-2026-82895

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

CVE-2026-93600 rustls webpki Name Constraints URI Validation Bypass

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

CVE-2026-93600

rustls-webpki (the X.509 certificate verification library in the Rust rustls ecosystem) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names , meaning such constraints are accepted but not enforced. The flaw is o...

CVE-2026-93600 rustls webpki Name Constraints URI Validation Bypass

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

CVE-2026-93600 rustls webpki Name Constraints URI Validation Bypass

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

CVE-2026-87915

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

CVE-2026-87915 Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

CVE-2026-87915

The Popup Maker WordPress plugin is vulnerable to unauthenticated stored cross-site scripting (XSS) via the values[Name] parameter in all versions up to and including 1.24.0 . The root cause is insufficient input sanitization and output escaping : although wp_kses is applied on output, HTML entit...

CVE-2026-87915 Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

EUVD-2026-82855

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

EUVD-2026-82777

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

CVE-2026-92554

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.5.1 . The flaw resides in the WL: Product Horizontal Filter widget , which reflects attacker-supplied query...

EUVD-2026-82747

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92554 ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...