CVE-2026-17567: Authorization Bypass Through User-Controlled Key

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

The vulnerability of the HtmlPolicyBuilder class in the Java library for sanitizing HTML code from OWASP Java HTML Sanitizer allows a malicious actor to gain unauthorized access to confidential information.

The vulnerability of the HtmlPolicyBuilder class in the Java library for sanitizing HTML code from OWASP Java HTML Sanitizer is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorize...

CVE-2026-63221: Improper Neutralization of Special Elements used in an SQL Command

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

@aws-amplify/amplify-util-uibuilder (>=1.2.13-studio-q1-release.0, <=1.14.27), @aws-amplify/cli (>=7.6.11-beta.0, <=7.6.26) +4 more potentially affected by CVE-2025-4318 via @aws-amplify/codegen-ui-react (>=2.1.0, <=2.14.2)

@aws-amplify/codegen-ui-react NPM version =2.1.0, =1.2.13-studio-q1-release.0, =7.6.11-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =0.1.0-alpha.0, =0.1.0-next.0 - edilkamin 0.0.1 Source cves: CVE-2025-4318 Source advisory: OSV:GHSA-HF3J-86P7-MFW8...

@aws-amplify/amplify-util-uibuilder (>=1.2.13-studio-q1-release.0, <=1.14.27), @aws-amplify/cli (>=7.6.11-beta.0, <=7.6.26) +4 more potentially affected by CVE-2026-18245 via @aws-amplify/codegen-ui-react (>=2.1.0, <=2.14.2)

@aws-amplify/codegen-ui-react NPM version =2.1.0, =1.2.13-studio-q1-release.0, =7.6.11-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =0.1.0-alpha.0, =0.1.0-next.0 - edilkamin 0.0.1 Source cves: CVE-2026-18245 Source advisory: SNYK:JS-AWSAMPLIFYCODEGENUIREACT-18601829...

SUSE CVE-2026-46618

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command...

SUSE CVE-2026-49821

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched...

SUSE CVE-2026-50565

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the...

SUSE CVE-2026-55079

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, NewDataBuilder in provisionersdk/proto/dataupload.go allocated a byte slice using the client-supplied FileSize from a...

SUSE CVE-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAllnameInArchive, "", "/", which turns a POSIX filename such as ....\evil.sh into the...

WordPress Cost Calculator Builder PRO plugin <= 4.0.3 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Cost Calculator Builder Pro versions = 4.0.3...

CLEANSTART-2026-EB78339 Security fixes in cass-config-builder 1.0.17-r0

Package cass-config-builder version 1.0.17-r0 fixes 1 vulnerabilities: ghsa-72hv-8253-57qq...

CVE-2026-15382

The Ultimate Addons for WPBakery Page Builder WordPress plugin, in versions before 3.21.4 , is vulnerable to an unauthenticated custom icon font deletion. The root cause is the failure to perform capability or nonce checks before processing requests to delete custom-uploaded icon font packs. An u...

EUVD-2026-51001

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-15382 Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-15382: External Control of File Name or Path

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

PT-2026-85861

Package cass-config-builder version 1.0.17-r0 fixes 1 vulnerabilities: ghsa-72hv-8253-57qq...

PT-2026-66400

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

The vulnerability of the FAB (Flask App Builder) authentication manager of the Apache Airflow network software allows a malicious individual to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the authentication manager of the Apache Airflow network software, Flask App Builder, is related to errors in verifying the cryptographic signature. Exploiting this vulnerability can allow an attacker to increase their privileges and gain unauthorized access to protected...

CVE-2026-13723

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...