CVE-2026-75953 Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-19055 ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin, in versions before 4.4.8 , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape certain query-string parameters reflected on one of its admin pages. Attackers can exploit this ...

EUVD-2026-62270

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

PT-2026-78813

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmi...

Wapiti Web Application Vulnerability Scanner 3.3.2

Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities. This is the source code release...

CVE-2026-16570: Improper Neutralization of Input During Web Page Generation

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

PT-2026-78812

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystore password and password parameters are not masked and are shown in...

CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

CVE-2026-23929 Prototype pollution leading to stored XSS

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75050

In JetBrains YouTrack, crafted type parameters allow a low-privilege network attacker to trigger a denial-of-service condition (CVSS 7.1, HIGH), with availability impact rated HIGH; no exploitation details are provided. Patch versions 2026.1.13901 and 2026.2.17950 are referenced as fixed.

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

EUVD-2026-60249

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

PYSEC-2026-3765

opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

CVE-2026-74880

The openssl_encrypt package (before 1.4.0) accepts refresh tokens as URL query parameters in its keyserver and telemetry server routes. Because URLs are logged in server logs, proxy logs, browser history, and HTTP Referer headers, attackers can extract these tokens to gain unauthorized access. Th...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...