EUVD-2026-54378

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

EUVD-2026-51620

Contao: Possible path traversal in job download URIs...

EUVD-2026-53954

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...

CVE-2026-17656 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-13477

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input...

CLEANSTART-2026-GX16359 Security fixes in confluent-common-docker 7.6.9-r3

Package confluent-common-docker version 7.6.9-r3 fixes 4 vulnerabilities: CVE-2025-11226, CVE-2026-1225, ghsa-25qh-j22f-pwp8, ghsa-qqpg-mvqg-649v...

EUVD-2026-49222

Unauthenticated Cross Site Scripting XSS in Product Feed Manager = 7.6.1 versions...

GHSA-P893-RVQ9-2XF9 ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Summary Heap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read ...

WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Product Feed Manager versions = 7.6.1...

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

CVE-2026-4942

CVE-2026-4942 affects IBM i releases 7.3–7.6 (5770-SS1). The issue arises in TLS negotiation where a remote attacker can craft a message to downgrade the TLS protocol to a version disabled by server configuration, leveraging an algorithm downgrade during negotiation. The IBM bulletin lists a CVSS...

ALPINE-CVE-2026-50012

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling peerDigestSwapInMask in src/peerdigest.cc, Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the masksize declared...

CVE-2026-47729

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway src/clients/FtpGateway.cc, Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed...

CVE-2026-50012 Squid: Memory corruption in cache_digest reply handling

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling peerDigestSwapInMask in src/peerdigest.cc, Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the masksize declared...

CVE-2026-50012

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling peerDigestSwapInMask in src/peerdigest.cc, Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the masksize declared...

CVE-2026-50012 Squid: Memory corruption in cache_digest reply handling

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling peerDigestSwapInMask in src/peerdigest.cc, Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the masksize declared...

CVE-2026-15306 Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15096

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'bwidthmap' Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-15096

The CVE concerns the Themify Builder WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the Map Module’s b_width_map field across all versions up to 7.7.6, caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or hig...

CVE-2026-59877

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends...