CVE-2026-7175: Improper Neutralization of Input During Web Page Generation

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

PT-2026-103775

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/custom form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...

PT-2026-105871

Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...

PT-2026-103774

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...

PT-2026-103772

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//edit general during...

PT-2026-104038

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...

PT-2026-103672

Name of the Vulnerable Software and Affected Versions WP Popular Posts versions prior to 7.4.3 Description An issue exists where unauthenticated attackers can extract sensitive information from non-public post objects, such as wp block synced patterns, which are typically protected by WordPress...

CVE-2026-7173: Improper Neutralization of Input During Web Page Generation

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events/ /editgeneral during...

CVE-2026-7176: Improper Neutralization of Input During Web Page Generation

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/ - /customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the even...

CVE-2026-100278

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...

EUVD-2026-90022

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...

CVE-2026-100278

In JetBrains YouTrack versions prior to 2026.2.19197 , a vulnerability allows users with restricted permissions to edit and hide comments belonging to other users. This flaw impacts the integrity of user comments within the platform. No specific exploit information or remediation details are prov...

EUVD-2026-90003

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-100278: Incorrect Authorization

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...

PT-2026-103325

🚨 CVE-2026-100278 In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments 🎖@cveNotify...

CVE-2026-92226

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

CVE-2026-92226

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

CVE-2026-92226 Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

CVE-2026-92226 Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

CVE-2026-102569

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...