CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71927

Multiple DrayTek VigorSwitch models are affected by a command injection vulnerability in the rebDevice function . The root cause is insufficient filtering of the username and password fields before they are passed to a system command execution context. A remote attacker with valid administrative ...

CVE-2026-71925 DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

EUVD-2026-64983

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

EUVD-2026-64888

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ntfs: Validating the values of the resident $INDEXROOT field during lookups. The values of the $INDEXROOT field carry index header fields that are consumed by callers after a lookup. Some callers already validate certain parts...

PT-2026-81273

Name of the Vulnerable Software and Affected Versions Media Sweep – WordPress Media Cleaner versions prior to 1.1.4 Description An issue exists where authenticated attackers with administrator-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of...

PT-2026-81015

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

PT-2026-80998

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

PT-2026-80959

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

CVE-2026-71503: Improper Neutralization of Input During Web Page Generation

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

PT-2026-81003

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

CVE-2026-71508: Missing Authorization

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

SUSE CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-2996

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.12.0 . The flaw resides in the form response message post meta fields (e.g., text_subscribed, text_error), caused by insufficient input sa...

EUVD-2026-64299

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561 MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...