CVE-2026-76346

CVE-2026-76346 is a stored XSS in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) caused by Splunk Web failing to escape tooltip values in dashboard sparkline format options. A user with the "power" role can inject a malicious script that executes in the browser of another u...

CVE-2026-18874

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

EUVD-2026-62669

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

CVE-2026-18874 Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

CVE-2026-18874

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

CVE-2026-76212

phpMyFAQ before 4.1.7 with native pgsql extension has a mismatched LIKE ESCAPE character in Search/Database/Pgsql.php, making wildcard escaping a no-op. Unauthenticated attackers can submit % or _ to force broad pattern matches and expensive sequential scans, causing denial of service. The PDO ba...

EUVD-2026-62453

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15780

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-62341

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-78558

Name of the Vulnerable Software and Affected Versions volsync-addon-controller affected versions not specified Description A flaw exists that allows the injection of malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This occurs because...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-102686)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102686 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versionsfrom 8.2. before 8.2.33, from 8.3. before 8.3.3...

CVE-2026-73336

Joomla! Core - 20260806 - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs...

CVE-2026-73336

Joomla! Core - 20260806 - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs...

SUSE CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

EUVD-2026-61032

Joomla! Core - 20260806 - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs...

CVE-2026-73336

In Joomla! 5.1.0–5.4.7 and 6.0.0–6.1.2, improper escaping flags allow cross-site scripting (XSS) through schema.org markup outputs. CVSS 4.0 scores it MEDIUM (5.1), requiring high privileges. No exploitation details are provided. Affected users should update to patched versions as announced by Jo...