CVE-2026-55692 EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...

CVE-2026-45115

MyBB's Buddy/Ignore component fails to escape single quotes in usernames via htmlspecialchars_uni(), enabling stored XSS in the User CP and Private Messages Select Buddies list. Victims are affected when confirming buddy removal in usercp.php or selecting buddies in the xmlhttp.php onclick handle...

SQL Injection via GeoJSON

Overview Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using STGeomFromGeoJSON, and MySQL GeoJSON documents using...