WordPress Quick Event Manager plugin <= 9.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by she11f in WordPress Plugin Quick Event Manager versions = 9.18...

CLEANSTART-2026-JY55743 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the apache-zookeeper package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

PT-2026-85077

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

PT-2026-85338

Description The path filters pick, ignore, filter, and replace — the library's headline "surgical extraction" feature — recompute the full path string from the nesting stack on every checkable token. Because the stack length equals the current nesting depth, and a checkable token is emitted at...

PT-2026-85122

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

PT-2026-85083

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

PT-2026-84991

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...

CVE-2026-84847: Missing Authorization

Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...

CVE-2026-85227: Improper Neutralization of Input During Web Page Generation

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

PT-2026-85121

Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...

CVE-2026-84848: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

The vulnerability of Windows Event Logging, a service in the Windows operating system, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Windows Event Logging service is related to the improper saving of generated signatures due to a violation of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-3416: Use of Insufficiently Random Values

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

EUVD-2026-58546

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion webhook signature bypass...

GHSA-MPF4-983Q-P7J4 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

EUVD-2026-68892

Tornado: Urlencoded body parsing omits maxnumfields, so one request can stall the event loop...

CVE-2026-83619

A flaw was found in xmldom, a JavaScript module used for processing XML documents. A remote attacker could exploit a vulnerability in the XML parser by submitting a specially crafted XML input. This could lead to a Denial of Service DoS, causing the affected system to become unresponsive by...

CVE-2026-82223

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

SUSE CVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...