CVE-2026-88007

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...

CVE-2026-84816

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-84819

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-81791

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81795

Unauthenticated Cross Site Scripting XSS in Page Visits Counter Lite = 1.2.3 versions...

CVE-2026-81782

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

Summary IBM Navigator for i and IBM Digital Certificate Manager DCM for i use Angular for frontend Graphical User Interfaces GUI. Angular is vulnerable to cross-site scripting XSS by permitting event-handler attributes in the i18n pipeline, allowing a lower-trust translation file to inject...

CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...

CVE-2026-88898 AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...

CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 contain a missing authorization check in the bulk publish endpoint , which fails to verify that the caller is authorized against the target workspace. An authenticated user can exploit this to publish content into other tenants' namespaces, writing vie...

EUVD-2026-75543

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...

CVE-2026-88898 AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery [CVE-2026-17047]

Summary The IBM Db2 Mirror for i GUI is vulnerable to Cross-Site Request Forgery CVE-2026-17047 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17047 DESCRIPTION: IBM Db2 Mirror for i could allow a remote attacker to obtain sensitive information due to...

CVE-2026-84816

CVE-2026-84816 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress WPCS (Currency Switcher) plugin , affecting versions ≤ 1.3.2 . The flaw allows a remote, unauthenticated attacker to inject script via network access, requiring user interaction, with changed scope and ...

CVE-2026-84819

Unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin WPAdverts affects versions ≤ 2.3.3 , as disclosed by researcher Ivaylo Atanassov via Patchstack. The flaw requires no authentication but does require user interaction, with a CVSS 3.1 score of 7.1 (HIGH) and changed ...

EUVD-2026-75534

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

EUVD-2026-75535

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-84819 WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-84816 WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-81795

CVE-2026-81795 affects the WordPress plugin Page Visits Counter – Lite in versions ≤ 1.2.3 , introducing an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw requires user interaction and has a CHANGED scope , meaning successful exploitation can impact the victim's browser sessio...