CVE-2026-56128

pfSense Plus before 26.07 and pfSense CE before 2.9.0 contain a stored cross-site scripting vulnerability in the firewall schedule editor. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The v...

CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CVE-2026-84238: Missing Authorization

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

CVE-2026-56128: Improper Neutralization of Input During Web Page Generation

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

PT-2026-85053

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall schedule edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into a...

WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jorgson in WordPress Plugin YITH Request a Quote for WooCommerce Premium versions 4.46.0...

PT-2026-83796

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.17.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Description Improper neutralization of input during web page generation occurs in the...

OESA-2026-3547 python-sqlparse security update

A non-validating SQL parser. Security Fixes: Summary sqlparse contains a Regular Expression Denial of Service ReDoS vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference \1 to match closing dollar-quote delimiters, causing On² CPU...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-redcarpet (UTSA-2026-032342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032342 advisory. Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting...

EUVD-2026-67136

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

curl: 56: IBM i CL wrapper `parse_command_line()` never enters quote mode

Summary In projects/OS400/curlcl.c, the parsecommandline function initializes quote to '\0' but no code path ever assigns an opening ' or " to it. The close-quote check line 82, quote-aware backslash handling line 88, and unterminated-quote error line 106 are all dead code. As a result, quote...

CVE-2026-75019

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

CVE-2026-75019 Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

CVE-2026-75019 Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

CVE-2026-78183

DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...

PT-2026-79782

Name of the Vulnerable Software and Affected Versions DBD::Pg version 3.21.0 Description A heap out-of-bounds write exists in the quote float function. The function allocates memory based on the string length plus one byte for the NULL terminator. However, when processing special literals such as...

CVE-2026-64972 Reflected XSS in ATutor

ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related previewtop.php file sanitises these parameters, but...

CVE-2026-71866

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

PYSEC-2026-3696 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...