EUVD-2026-57533

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

CVE-2026-73332 CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

CVE-2026-73332 CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

CamaleonCMS contains a stored cross-site scripting vulnerability in the camacontactform plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the beforehtml field through the contact form edit endpoint, which lacks proper...

CVE-2026-72786

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the handling of bulk requests to the PATCH /api/v2/variables and PATCH /api/v2/connections endpoints. An attacker can obtain sensitive secret values in cleartext by accessing the audit...

CVE-2026-68446

A flaw was found in the drm/vmwgfx component of the Linux kernel. This vulnerability arises from insufficient validation of the vmwsurfacemetadata::arraysize field, which is supplied by userspace. An attacker could exploit this by providing a malformed arraysize value, potentially leading to...

CVE-2026-47233

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233

CVE-2026-47233 details an incomplete fix in Admidio where field_delete in modules/inventory.php validates only a CSRF token and does not enforce isAdministratorInventory(), allowing any logged-in user to delete non-system inventory fields. The related ItemField::delete() path lacks an admin check...

EUVD-2026-57214

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

WordPress Formidable Digital Signatures plugin <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field vulnerability

Unauthenticated Arbitrary File Deletion via Signature Field vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Formidable Digital Signatures versions = 3.0.6...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

CVE-2026-16977 Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin (versions before 1.15.45 ) is vulnerable to second-order SQL injection . The flaw exists because the plugin fails to properly parameterize a user-controlled value substituted into a dynamic SQL query for a database-backed choice field. This allows users wi...