PT-2026-79073

Name of the Vulnerable Software and Affected Versions dropbox samly versions 0.3.0 and later Description An issue exists where the service provider fails to properly verify the authenticity of SAML responses. Specifically, the validate authresp/3 function in lib/samly/sp handler.ex does not compa...

PT-2026-79183

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active...

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...

EUVD-2026-62699

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink...

CVE-2026-62669

Grav Login Plugin (for Grav CMS) prior to 3.8.11 contains a two-factor authentication bypass in the login.regenerate2FASecret task. The root cause is an insufficient authorization check: the task verifies only that the pending-session user exists rather than requiring $user->authorized. An att...

CVE-2026-40507

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...

CVE-2026-40507 OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...

EUVD-2026-62504

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...

CVE-2026-40507 OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...

CVE-2026-40507

OpenEMR before 8.3.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the patient portal template import handler . The templateHtml GET parameter is reflected into the page response without sanitization, allowing an attacker to craft a URL that executes arbitrary JavaScript ...

PYSEC-2026-3702 tablib: Stored XSS in the HTML export via unescaped dataset title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-18031

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

CVE-2026-18031 TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

CVE-2026-18031

The TabaPay Gateway WordPress plugin (versions

EUVD-2026-62276

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

PT-2026-78290

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

PT-2026-78647

Name of the Vulnerable Software and Affected Versions pfSense Plus versions prior to 26.07 pfSense CE versions prior to 2.8.2 Description A stored cross-site scripting issue exists in the Traffic Graphs top-talkers feature. The system incorporates PTR records pointers used in reverse DNS lookups ...

PT-2026-78737

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user possessing an embedded report token...

PT-2026-78435

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0 Description A reflected cross-site scripting issue exists in the patient portal template import handler. The templateHtml GET parameter is reflected in the page response without proper sanitization. This allows ...

PT-2026-80673

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export book method in t...