CVE-2026-13424 Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via booklyspeedupupdateaddons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-19838

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The...

EUVD-2026-58709

A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has...

CVE-2026-19836

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

CVE-2026-19834

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

MINI-CF7V-M64R-GPR2

Bulletin has no description...

The vulnerability in the component drm/panel/panel-simple.c of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the drm/panel/panel-simple.c component of the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-15217

creationtimestamp| type| source ---|---|--- 2026-08-13 10:21:54+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-20 2026-08-13 14:05:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msxssijrld2m 2026-08-13 20:15:15+00:00| seen|...

CVE-2026-18146 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

PT-2026-71733

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.7.0-RC5 Description A cross-site request forgery CSRF issue exists in the 'lists/admin/admins.php' endpoint. The administrator deletion action is triggered via a GET request using the delete parameter that lacks CSR...

PT-2026-71524

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-54463 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips...

CVE-2026-72787

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

EUVD-2026-57447

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787

CVE-2026-72787 affects Craft CMS versions before 5.10.8. A stored XSS exists in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of hig...

CVE-2026-72787

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-73330 CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...