CVE-2026-84021: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

CVE-2026-19861: Improper Neutralization of Input During Web Page Generation

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...

CVE-2026-19858: Exposure of Sensitive Information to an Unauthorized Actor

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

CVE-2026-19769: Improper Neutralization of Input During Web Page Generation

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18843: Improper Neutralization of Input During Web Page Generation

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18406: Improper Neutralization of Input During Web Page Generation

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-86345

🚨 CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected...

PT-2026-86323

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no results message' node preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-85670

tokenizers Hugging Face is affected by an out-of-bounds buffer access in BpeBuilder::build tokenizers/src/models/bpe/model.rs. When loading a tokenizer.json via Tokenizer::fromfile/fromstr, the builder sizes a scratch buffer to the longest vocabulary key, then writes each concatenated merge rule...

CVE-2026-79707

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...

CVE-2026-79707

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...

CVE-2026-82923

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...

EUVD-2026-70994

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...

CVE-2026-79707

A Path Traversal vulnerability in the builder endpoint of Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 (Python) allows an unauthenticated remote attacker to read arbitrary files by supplying a crafted file_path query parameter. The CVSS 4.0 base score is 8.7 (HIGH) , ref...

CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...

CVE-2026-82923

The AI Website Builder WordPress plugin (GitHub build 1.0.0 ) lacks any authorization or nonce check on its REST API routes. This allows an unauthenticated attacker to install and activate plugins and themes, import content from an attacker-controlled URL, write an arbitrary file into the uploads...

CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

EUVD-2026-70990

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...