CVE-2026-82451 Formwork < 2.3.11 Stored XSS via Referer Header

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

EUVD-2026-68106

Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

CVE-2026-82451 Formwork < 2.3.11 Stored XSS via Referer Header

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

PT-2026-83430

Name of the Vulnerable Software and Affected Versions Formwork versions prior to 2.3.15 Description A stored cross-site scripting issue exists in the visit tracking feature. The system records the host from the Referer header without proper escaping. This allows unauthenticated attackers to injec...

SUSE CVE-2026-72118

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-81732 WWBN AVideo through 30.0 Information Disclosure via report4.json.php

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts...

CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

CVE-2026-32479

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479

CVE-2026-32479 is an unauthenticated SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro , affecting versions ≤ 11.17 . The vulnerability was discovered by Trương Hữu Phúc (Patchstack). The CVSS 3.1 score is 9.3 (Critical) , with a network attack vector, low complexity ...

CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

WordPress WP Statistics plugin < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers vulnerability

Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers vulnerability discovered by Shivamani Vastrala in WordPress Plugin WP Statistics versions 14.16.10...

PT-2026-82442

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104775)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104775 advisory. Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.17...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - tcp: tcpmakesynack can now be called from process context. - tcprtxsynack can now be called in process context, as explained in 0a375c822497 "tcp: tcprtxsynack can be called from process context". - tcprtxsynack may call...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fixed a memory leak in the WMI firmware stats. The memory allocated for firmware pdev, vdev, and beacon statistics is not released during rmmod. This issue was fixed by calling the ath11kfwstatsfree function before...

Astra Linux – Vulnerability in PostgresSQL 11

PostgreSQL optimizer statistics enable users to read sampled data within views that the user cannot access. Additionally, statistics allow users to access sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; th...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: mwifiex: The chanstats array is initialized to zero. The adapter-chanstats array is initialized in mwifiexinitchannelscangap using vmalloc, which does not zero out the memory. The array is filled in during...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: Prevent the creation of classes with TCHROOT. The function qdisctreereducebacklog uses TCHROOT as a termination condition when traversing the qdisc tree to update parent backlogs. However, if a class is created with...