CVE-2026-77793 RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...

CVE-2026-77793

RegistrationMagic is a WordPress plugin that manages event registrations. Versions prior to 6.0.9.9 fail to validate the total price of a paid registration server-side; an attacker can simply omit the price field in the request to complete a paid registration without paying, obtaining an activate...

CVE-2026-81269

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

EUVD-2026-70003

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81269

The Drupal Data field module (versions 0.0.0 to 2.0.13 ) contains a Missing Authorization vulnerability that allows Forceful Browsing . The root cause is that the module fails to sufficiently verify access permissions when returning structured data values through its JSON endpoints . This allows ...

CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

SUSE CVE-2026-70405

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

SUSE CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

CVE-2026-77792 RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin...

CVE-2026-77792 RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin...

CVE-2026-77792

The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape a registration form field value—specifically the Rating Field —before it is outputted into an HTML attribute on an administrative pag...

CVE-2026-19754

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

EUVD-2026-69829

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701

NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...