PT-2026-72924

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned dev info fields in ublk ctrl add dev ublk ctrl add dev memcpys the userspace ublksrv ctrl dev info into ub-dev info and then fixes up the fields the driver owns, but misses -state and -ublksrv pid. A devi...

CVE-2026-15993: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

PT-2026-72827

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seq buf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX FILTER STR VAL buffers. The current code appends those strings wit...

Linux Distros Unpatched Vulnerability : CVE-2026-68470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX pa...

CVE-2026-73050: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

PT-2026-72153

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.45 Description An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameter...

CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

CVE-2026-72821

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...

EUVD-2026-58635

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...

CVE-2026-72821

Grav Form plugin (before v9.1.15) contains a stored XSS in radio and toggle field option labels rendered via Twig |raw. With form authoring permissions, an attacker can inject HTML/script into option labels that executes in the browsers of visitors and admins viewing the form. The issue is caused...

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin (versions before 6.7.2 ) is vulnerable to an unauthenticated privilege escalation via a mass assignment vulnerability. The plugin fails to prevent user-supplied registration fields from overwriting reserved account attributes. This allows an una...

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

Foxit PDF Editor < 13.2.6 / 14.0.6 / 2026.1.3 Vulnerability

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2026.1.3/14.0.6/13.2.6. It is, therefore affected by vulnerability: - Foxit PDF Editor/Reader inconsistently alerts users when signature fields are...

PT-2026-71990

Name of the Vulnerable Software and Affected Versions Grav Form plugin versions prior to 9.1.15 Description A stored cross-site scripting issue exists where radio and toggle field option labels are rendered using the Twig |raw filter. This allows attackers with form authoring permissions to injec...

CVE-2026-72821: Improper Neutralization of Input During Web Page Generation

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...

CVE-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

CVE-2026-73559

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded liststr or listlistint, prompttoseq in vllm/renderers/inputs/preprocess.py and...

CVE-2026-66772

creationtimestamp| type| source ---|---|--- 2026-08-13 08:48:23+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0998...

PT-2026-71782

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...