CVE-2026-81869

A flaw was found in OpenTelemetry-Go. An attacker who can control span attribute content can bypass the attribute length truncation mechanism. This occurs when string attributes contain the Unicode replacement character U+FFFD, preventing the enforcement of configured memory limits. This...

CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-32641: Uncaught Exception

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

PT-2026-95519

Name of the Vulnerable Software and Affected Versions Mongoid affected versions not specified Description An insecure direct object reference exists in the nested attributes handling of the Mongoid object-document mapper. This allows a user with basic application privileges to reference a record...

Linux Distros Unpatched Vulnerability : CVE-2026-93056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and...

PT-2026-95721

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5 Description Stored cross-site scripting occurs because the software fails to escape heading style attributes when rendering HTML for the outline and bookmark dock. Attackers can inject malicious style values by...

CVE-2026-93758: Authorization Bypass Through User-Controlled Key

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual...

EUVD-2026-82532

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

@platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

EUVD-2026-81354

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

EUVD-2026-81316

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin (versions up to and including 1.8.44 ) is vulnerable to Stored Cross-Site Scripting (XSS) via its Shortcode Attributes due to insufficient input sanitization and output escaping. According to the initial description, the ...

CVE-2026-86311: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

PT-2026-94138

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.45 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the shortcode attributes...

CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-92217 a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...