SUSE CVE-2026-65341

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption...

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...

PT-2026-97175

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description The plugin fails to verify the necessary permissions required to publish content when creating or updating entries via its REST API. This allows users with restricted...

PT-2026-97410

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.29.0 Description The software fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. This allows attackers to inject JavaScript via crafted...

PT-2026-97674

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...

PT-2026-97273

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

PT-2026-97233

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A signature validation issue exists in the way Foxit PDF Editor/Reader handles incrementally updated PDF documents. This flaw allows changes to be made to the visible content ...

PT-2026-97164

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient sanitization and restriction of HTML in user-submitted content allows users with subscriber-level accounts and above to perform stored HTML injection. This issu...

PT-2026-97502

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31 Description An authenticated user can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data. This occurs because the...

PT-2026-97346

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

PT-2026-97196

Name of the Vulnerable Software and Affected Versions The Event Booking Manager for WooCommerce versions prior to 5.7.3 Description The plugin fails to restrict its event listing query to events that the requesting user is authorized to view. Consequently, users with contributor-level access or...

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...

CVE-2026-95626: Improper Neutralization of Input During Web Page Generation

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

CVE-2026-92692: Improper Neutralization of Special Elements used in an SQL Command

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...

CVE-2026-95847: Improper Control of Resource Identifiers

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-86842: Missing Authorization

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...

CVE-2026-86601: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-81338: Insufficient Verification of Data Authenticity

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-91788: Exposure of Resource to Wrong Sphere

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it...

CVE-2026-91814: Improper Verification of Cryptographic Signature

A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the...