EUVD-2026-50165

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Link Library allows Cross-Site Scripting XSS. This issue affects Link Library: before 7.9.4...

CVE-2026-64940

creationtimestamp| type| source ---|---|--- 2026-07-29 04:45:06+00:00| seen| https://jvn.jp/en/jp/JVN99975039...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-17161

The CVE-2026-17161 entry documents a Stored Cross-Site Scripting vulnerability in the WowStore – Store Builder & Product Blocks for WordPress plugin. Affected: WordPress plugin WowStore (Product Blocks) up to version 4.4.24. Vulnerable component: the filterMobileText Block Attribute; root cause i...

CVE-2026-17166

The CVE concerns The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (WordPress) with an authorization bypass in all versions up to and including 5.3.7. The root cause is that the plugin does not properly verify that a user is authorized to perform ...

CVE-2025-69942

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...

EUVD-2025-210531

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

CVE-2025-65337

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

An advisory for this issue has been issued at https://www.drupal.org/sa-contrib-2026-110 and an additional issue was identified and fixed via https://www.drupal.org/sa-contrib-2026-111 This module is now resupported. See that advisory for more details. Original content The security team is markin...

CVE-2026-56722

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-47725

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

SUSE CVE-2026-64552

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

CVE-2026-54632

creationtimestamp| type| source ---|---|--- 2026-07-28 17:04:21+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mrpve7kkpq24...

CVE-2026-18084 Cross-Site Scripting (XSS) in Management Console of BlackBerry UEM

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting XSS. This issue affects UEM: 12.23.0 QF8 or earlier...

EUVD-2026-49898

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting XSS. This issue affects UEM: 12.23.0 QF8 or earlier...

CVE-2026-18084

CVE-2026-18084 is an XSS vulnerability in the BlackBerry UEM Management Console due to improper neutralization of input during web page generation. Affected: BlackBerry UEM 12.23.0 QF8 or earlier. Impact: cross-site scripting with high potential impact; no exploitation details or remediations pro...

CVE-2026-64369

A flaw was found in the Linux kernel, specifically within the s390 architecture. When the system attempts to read unaligned data that spans across memory pages, it can trigger exceptions. For memory pages designated for secure execution by the Ultravisor, the exception handling mechanism does not...

CVE-2026-62428

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is "pinned", what is...

CVE-2026-62428

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is "pinned", what is...

CVE-2026-15393

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and...