CVE-2026-8595 Stored XSS in the table panel (TableNG)

A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting...

EUVD-2026-42922

A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting...

decompress: Decompress: File disclosure and corruption via arbitrary hardlink creation

A flaw was found in decompress. An attacker can craft a malicious archive that, when extracted, allows for arbitrary hardlink creation. This vulnerability occurs because the x.linkname field from hardlink entries in the archive is processed without proper validation, enabling an attacker to creat...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

CVE-2026-15284

The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formpageid' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the addtosubmissions function, which applies sanitizetextfield which preserves...

GHSA-28JH-G32X-V9V4 Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values

Summary Tesla.Multipart.partheadersfordisposition/1 interpolates Content-Disposition parameter values field name, filename, and other opts verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition...

PT-2026-57271

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0 Description In the IT asset and license management system, the update function within UsersController incorrectly handles missing permission request fields when processed through NormalizePermissionsPayloadActi...

PT-2026-57275

The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...

CVE-2026-12535: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0...

CVE-2026-13242: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0...

CVE-2026-55809: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-55469: Improper Limitation of a Pathname to a Restricted Directory

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the...

PT-2026-57211

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A user with Editor permissions can create a dashboard where the TableNG panel includes a malicious field name. This leads to stored cross-site scripting XSS, a...

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

Summary An unsafe execution vulnerability exists in the Bazar form field calculator CalcField.php of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval function. This implementation is...

GHSA-PX5M-H76G-P7P8 YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

Summary An unsafe execution vulnerability exists in the Bazar form field calculator CalcField.php of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval function. This implementation is...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the rendering of form field labels and hints within templates due to improper output escaping. An attacker can execute arbitrary JavaScript code in the context of users viewing affected forms b...

GHSA-XC7J-3G8Q-9VH4 YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))

Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts — stored XSS in form renders sibling class of commit e6b66aa CWE: CWE-79 Improper Neutralization of Input During Web Page Generation, "Cross-site Scripting" via CWE-116 Improper...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine in the renderFromStringNoEscape process. An attacker can execute arbitrary code on the server by injecting malicious Twig expressions into the semantic template field...

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Summary Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including...

GHSA-PQPW-CVM4-8MV9 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Summary Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including...