CVE-2026-49466

Draft List (WordPress plugin) versions

CVE-2026-72803

SiYuan before v3.7.4 fails to enforce publish-access checks in getBlockAttrs and batchGetBlockAttrs. An attacker can retrieve block attributes (names, aliases, memos, custom fields) from protected documents by sending POST requests with block IDs. Affected: SiYuan

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to improper inbound filtering of SQS message attributes, which allows an attacker who can send messages to the SQS queue to inject arbitrary Camel control headers, potentially influencing downstream producers such a...

PT-2026-71245

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks in the 'getBlockAttrs' and 'batchGetBlockAttrs' endpoints allow attackers to retrieve block attributes from protected documents. By sending POST requests containing...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

CVE-2026-68287

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix size calculations for 64-bit attributes netdmpacketreportfill and netdmhwpacketreportfill use nlaputu6464bit to append 64-bit attributes NETDMATTRPC and NETDMATTRTIMESTAMP. On 32-bit architectures without...

AZL-94968 CVE-2026-68287 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix size calculations for 64-bit attributes netdmpacketreportfill and netdmhwpacketreportfill use nlaputu6464bit to append 64-bit attributes NETDMATTRPC and NETDMATTRTIMESTAMP. On 32-bit architectures without...

EUVD-2026-55388

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix size calculations for 64-bit attributes netdmpacketreportfill and netdmhwpacketreportfill use nlaputu6464bit to append 64-bit attributes NETDMATTRPC and NETDMATTRTIMESTAMP. On 32-bit architectures without...

CVE-2026-68287 drop_monitor: fix size calculations for 64-bit attributes

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix size calculations for 64-bit attributes netdmpacketreportfill and netdmhwpacketreportfill use nlaputu6464bit to append 64-bit attributes NETDMATTRPC and NETDMATTRTIMESTAMP. On 32-bit architectures without...

Exploit for CVE-2026-15598

CVE-2026-15598 A weakness has been identified in antv layou...

CVE-2026-15047

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-15047

The s2Member WordPress plugin (versions prior to 260805 ) is vulnerable to a stored Cross-Site Scripting (XSS) attack. The root cause is the failure to escape several shortcode attributes before they are outputted within an inline script context . This allows users with contributor-level access t...

CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

EUVD-2026-54995

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

Exploit for CVE-2026-53787

CVE-2026-53787 - Amasty Order Attributes Unauthenticated File...

CVE-2026-15047: Improper Neutralization of Input During Web Page Generation

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

PT-2026-69347

Name of the Vulnerable Software and Affected Versions s2Member WordPress plugin versions prior to 260805 Description The plugin fails to escape several shortcode attributes before they are output within an inline script context. This allows users with contributor-level access to perform a stored...

SUSE CVE-2026-64531

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

EUVD-2026-54728

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument...