CVE-2026-88828

The Blacklist Manager for WooCommerce WordPress plugin, affecting versions 1.3.0 through 2.3.1 , contains a vulnerability where user blocking is not enforced across all authentication paths. Specifically, an account blocked by a site owner can continue to authenticate and maintain account privile...

CVE-2026-100904

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argume...

CVE-2026-100904 amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argume...

CVE-2026-100904 amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argume...

CVE-2026-100904

The amirsanni mini-inventory-and-sales-management-system is vulnerable to a cross-site scripting (XSS) flaw within the Items Management Module . Specifically, an unknown function in the file application/controllers/Items.php fails to properly handle the itemName argument, allowing for remote expl...

EUVD-2026-88071

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argume...

Important: python3-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the...

Important: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the...

CVE-2026-49994: Missing Authentication for Critical Function

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-81375: Externally Controlled Reference to a Resource in Another Sphere

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-19759: Incorrect Authorization

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged...

CVE-2026-100904: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argume...

PT-2026-102288

Name of the Vulnerable Software and Affected Versions Bluehood versions prior to 0.7.1 Description When auth enabled is active, session validation is only enforced on HTML page handlers. The /api/ endpoints, including /api/device/mac/notes, do not perform authentication checks. A network attacker...

PT-2026-99844

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged...

PT-2026-99851

Name of the Vulnerable Software and Affected Versions Google Cloud Application Integration versions prior to 2026-06-28 Description A Deserialization of Untrusted Data issue in the JavaScript Task on Google Cloud Platform allows an authenticated user with standard permissions to execute arbitrary...

PT-2026-99850

Name of the Vulnerable Software and Affected Versions Google Cloud Application Integration versions prior to 2026-06-30 Description A Confused Deputy issue in the EmailTask component on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files...

PT-2026-99760

Name of the Vulnerable Software and Affected Versions amirsanni mini-inventory-and-sales-management-system versions up to 81bf0b55f5933f3b0dbb1583204a612e06605b95 Description A cross site scripting issue exists within the Items Management Module in the file application/controllers/Items.php. Remo...

PT-2026-99945

Name of the Vulnerable Software and Affected Versions ag-ui-protocol ag-ui versions prior to 2026-09-08 Description A flaw in the Middleware component within the file legacy/convert.ts affects the JSON.parse function. This issue allows remote exploitation by manipulating input to trigger an...

Important: resteasy-base

Issue Overview: A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts...

The vulnerability of the RedisArrayAggregator component in the networking application development framework, developed using Netty protocols, allows a attacker to cause service interruptions.

The vulnerability of the RedisArrayAggregator component in the networking application development framework, used for servers and client protocols based on Netty, involves an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruption...