PT-2026-85456

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

PT-2026-85502

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

PT-2026-85418

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

CVE-2026-85602: Reliance on Untrusted Inputs in a Security Decision

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

PT-2026-85452

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.1.0 through 9.3.3 Description A mismatch occurs because the middleware evaluates the raw request target to determine if path-scoped middleware should run, whereas the Fastify router resolves an absolute-form request...

VulnCheck KEV: CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2026-81300

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-81300 WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-81300 WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-81300

CVE-2026-81300 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the Calculation For Contact Form 7 WordPress plugin in versions ≤ 1.0 . The CVSS v3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-based attack with low comple...

EUVD-2026-70593

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-84647

A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enablin...

tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-81300: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

PT-2026-85090

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-84311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and...

Linux Distros Unpatched Vulnerability : CVE-2026-84379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates...

CVE-2026-84379

A flaw was found in HTTPX2, a Python HTTP client. A remote attacker could exploit this vulnerability by sending specially crafted multipart/form-data requests. The FileField.renderheaders function fails to validate Content-Type values and custom headers, allowing the injection of Carriage Return ...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...