PT-2026-95300

Name of the Vulnerable Software and Affected Versions ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin versions prior to 3.5.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occur...

PT-2026-95490

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.6 Description A parameter order bug in the hostnameRegexHandler.OnUpdate function within internal/webhook/tenant/validation/hostname regex.go causes the webhook to validate the old Tenant object instead of...

CVE-2026-92554: Improper Neutralization of Input During Web Page Generation

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-95344

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injectin...

CVE-2026-89330: Improper Neutralization of Input During Web Page Generation

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

PT-2026-95299

Name of the Vulnerable Software and Affected Versions Qi Addons For Elementor versions prior to 1.12 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when the Table of Contents widget is placed o...

PT-2026-95499

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions prior to 7.2.0 Description Semantic MediaWiki is an open-source extension for MediaWiki used for storing and querying data. The software fails to apply sufficient output-context encoding when the value parameter is...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3761)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

CVE-2026-63458: Authorization Bypass Through User-Controlled Key

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-90981: Improper Neutralization of Input During Web Page Generation

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

Tenda FH451 WrlclientSet Code Execution

The vulnerability of the WrlclientSet function /goform/WrlclientSet of the Tenda FH451 router microprogramming system is related to buffer overflow in the stack when processing the GO parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Tenda CH22 FormWriteFacMac Arbitrary Command Execution

The vulnerability of the FormWriteFacMac function in the /goform/WriteFacMac file of the Tenda CH22 microprogramming system is related to the failure to take measures to neutralize special elements during the processing of the mac parameter. Exploiting this vulnerability can allow an attacker to...

httpd daemon Code Execution

The vulnerability of the fromWrlclientSet function in the httpd daemon’s microprogramming system for Tenda FH1202 is related to the issue where an operation is performed outside the buffer in memory when processing the GO parameter. Exploiting this vulnerability allows a remote attacker to execut...

Tenda CH22 Parameter Handler Heap Buffer Overflow

The vulnerability of the Parameter Handler component in the fromSetCfm function of the /goform/setcfm microprogramming system Tenda CH22 is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

Tenda F456 Router Code Execution

The vulnerability of the fromaddressNat function /goform/addressNat in the Tenda F456 router’s microprogramming system is related to the copying of buffers without checking the size of the input data when processing the manufacturer parameter. Exploiting this vulnerability allows an attacker to...

Tenda CH22 Router Code Execution

The vulnerability of the formWrlExtraSet /goform/WrlExtraSet function in the Tenda CH22 router microprogramming system lies in the reading of data outside the buffer in memory during the processing of the GO parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or...

httpd daemon WrlExtraSet() Code Execution

The vulnerability of the WrlExtraSet function in the httpd daemon of the microprogramming router Tenda FH1202 is related to the execution of an operation outside the buffer in memory when processing the GO parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

FreeBSD LcpDecodeConfig Heap Buffer Overflow DoS

The vulnerability of the LcpDecodeConfig function in the kernel of the FreeBSD operating system is related to improper handling of discrepancies in parameter length. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

CVE-2026-85511: Authentication Bypass by Spoofing

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...