EUVD-2026-54557

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

CVE-2026-48093

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

EUVD-2026-54519

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-17595

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-17595

Nexus Repository 3 is affected by a JEXL Content Selector sandbox bypass where an account with nexus:selectors:create could read Java object properties not intended for exposure, potentially revealing internal JVM class metadata (e.g., class and classloader names). The issue stems from incomplete...

GHSA-55Q2-FJHQ-7XH7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Summary During INPLACE sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize returns, even though the returned root is clean and the image remains disconnect...

CVE-2026-48094 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-48094

CVE-2026-48094 affects the ShareOpenly WordPress plugin (prior to 1.2.1). The issue is a Cross-Site Scripting (XSS) vulnerability caused by omitting WordPress esc_url() when rendering a URL into an HTML href. The vulnerable code builds the URL from home_url( add_query_arg( array(), $wp->reques...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

CVE-2026-54214

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger says HTTP Terminator, an artificial intelligence AI-assisted research system built by James Kettle , generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a...

CVE-2026-54214

CVE-2026-54214 describes an HTTP header injection vulnerability in Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability arises from the vulnerable Type URL parameter, which can inject control characters (e.g., URL-encoded newlines %0a and colons) to modify the Content-Type header in HTTP...

CVE-2026-54214 TeamDavid: Header Injection through the 'cType' URL parameter

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

CVE-2026-54214

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

CVE-2026-54208 TeamDavid: Arbitrary File Write leading to Stored XSS

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

CVE-2026-71497

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...

CVE-2026-15361

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...