CVE-2026-95593: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Ultimeter = 3.0.8 versions...

CVE-2026-94168: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-93620: Missing Authorization

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

CVE-2026-70125: Heap-based Buffer Overflow

Microsoft Office Outlook Remote Code Execution Vulnerability...

CVE-2026-94080: Missing Authorization

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

CVE-2026-71461: Generation of Error Message Containing Sensitive Information

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-87898: Improper Neutralization of Special Elements used in an OS Command

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-95528: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...

CVE-2026-94118: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...

CVE-2026-94391: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...

CVE-2026-95957: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...

CVE-2026-94682: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...

CVE-2026-94671: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-95515: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...

CVE-2026-93773: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

Karma Pro 0.10

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

CVE-2026-94680: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-95529: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...

CVE-2026-68490: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...