CVE-2026-76201: Improper Neutralization of Input During Web Page Generation

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

CVE-2026-86499

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...

CVE-2026-86499

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...

CVE-2026-86499

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...

EUVD-2026-72515

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...

CVE-2026-86499

JetBrains YouTrack before version 2026.1.14047 contained an information disclosure flaw in its predefined search fields , which leaked all group names to any user regardless of their visibility permissions. The vulnerability is rated CVSS 4.3 (Medium) with a network attack vector, low complexity,...

EUVD-2022-56046

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

SUSE-SU-2026:23523-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issue: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725...

PT-2026-86871

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...

CVE-2026-86499: Missing Authorization

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

EUVD-2026-72113

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257

CVE-2026-86257 affects wger before version 2.6 . The root cause is a lack of sanitization on the first_name and last_name fields in the gym member TSV export endpoint , enabling any gym member to inject spreadsheet formulas such as =HYPERLINK. When an admin opens the exported file in Excel or Lib...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

EUVD-2026-72108

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-pars...

CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

PT-2026-86521

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-pars...

CVE-2026-82846 Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the cours...

CVE-2026-82846

The Masteriyo LMS WordPress plugin (versions 1.18.0-2.3.3 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw because it fails to properly sanitize and escape certain course settings. An attacker with a course-author role can inject malicious scripts into these settings, which then execut...