CVE-2026-81153 Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the...

CVE-2026-81153

The Robo Gallery WordPress plugin, in versions prior to 5.2.6 , is vulnerable to Stored Cross-Site Scripting (XSS) due to the failure to properly sanitise and escape certain image settings before they are rendered on a gallery page. This flaw allows users with Author roles or higher to inject mal...

CVE-2018-17463

CVE-2018-17463 CVE-2018-17463에 대한 작업 개념 증명 익스플로잇으로, WebAssembly RWX 페이지를 활용하여 셸코드를 실행합니다. CVE-2018-17463은 Google Chrome 70.0.3538.64 이전 버전의 V8에서 잘못된 부작용 주석side effect annotation으로 인해 발생했으며, 원격 공격자가 조작된 HTML 페이지를 통해 샌드박스 내에서 임의 코드를 실행할 수 있게 했습니다. 이 개념 증명은 다음 블로그 게시물과 직접 관련이 있습니다: Chrome 브라우저 익스플로잇...

CVE-2026-40176

CVE-2026-40176 — Внедрение команд в драйвере Perforce Composer Proof of Concept Автономное, объектно-ориентированное PHP-подтверждение концепции, которое демонстрирует и дифференциально проверяет уязвимость внедрения команд в драйвере репозитория Perforce для Composer. PoC запускает один и тот же...

CVE-2026-107841 pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether t...

CVE-2026-107841 pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether t...

EUVD-2026-95937

pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether t...

The Amplifier Effect: Human-Factor Risks of AI-Suggested Correlation and Auto-Propagation in Multi-Framework GRC Self-Assessment

Multi-framework Governance, Risk and Compliance GRC platforms increasingly automate the link between an organisation's self-assessment answer and the compliance obligations that answer is said to satisfy. Cross-framework control mapping, AI-suggested question correlation, and automatic propagatio...

PT-2026-106530

In the Linux kernel, the following vulnerability has been resolved: Input: zero ff effect before compat copy in input ff effect from user In the compat path input ff effect from user aliases the caller's native struct ff effect with the smaller struct ff effect compat and copies only the compat...

Where the Numbers Come From: Auditing Evaluation in Provenance-Based Intrusion Detection

Reproducing a provenance-based intrusion detector's score does not establish what that score says about its emitted alarms or the information its encoder uses. We audit nine released implementations, execute four detectors using their own code, and isolate three measurement effects. First, a...

CVE-2026-96755

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755

Versions 8.14.0 through 8.28.1 of orval are vulnerable to a code injection vulnerability within the @orval/effect generator. The root cause is the improper conversion of OpenAPI schema defaults into template literals . An attacker can inject arbitrary JavaScript expressions by including ${...} sy...

EUVD-2026-85405

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-91073

The Subscribe Forms WordPress plugin (versions 1.4.1-1.6.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape specific form settings before they are outputted on a page. This allows authenticated users with the Author role ...

CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

PT-2026-97408

Name of the Vulnerable Software and Affected Versions orval versions 8.14.0 through 8.28.1 Description The @orval/effect generator improperly converts OpenAPI schema defaults into template literals. This allows for code injection where arbitrary JavaScript expressions using the $... syntax can be...