CLSA-2026-1776818216 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.1.4-tuxcare.1...

CLSA-2026-1776818195 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1774743826 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.1.4-tuxcare.1...

CLSA-2026-1774743810 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.0.8-tuxcare.1...

CLSA-2026-1774743825 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.3.3-tuxcare.1...

CLSA-2026-1773188144 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 1.0.0-rc3-tuxcare.1...

CLSA-2026-1773101683 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.2.0-tuxcare.1...

Malicious code in @servicetitan/form (npm)

npm/@servicetitan/form is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11870 Malicious code in @servicetitan/form (npm)

npm/@servicetitan/form is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @servicetitan/form-state (npm)

npm/@servicetitan/form-state is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

WordPress Booking Calendar Contact Form plugin <= 1.0.23 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions = 1.0.23...

WordPress Booking Calendar Contact Form plugin <= 1.0.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions = 1.0.23...

WordPress Booking Calendar Contact Form plugin <= 1.1.24 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions = 1.1.24...

WordPress Contact Form Builder, Contact Widget plugin <= 1.6.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Milad karimi in WordPress Plugin Contact Form Builder, Contact Widget versions = 1.6.1...

WordPress International Sms For Contact Form 7 Integration plugin <= 1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Milad karimi in WordPress Plugin International Sms For Contact Form 7 Integration versions = 1.2...

Exploit for CVE-2026-17543

PHP CVE-2026-17543 Exposure Validator Safe network-side valid...

WordPress Database for CF7 plugin <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Chawabhon Netisingha JNX03 in WordPress Plugin Database for CF7 versions = 1.2.6...

CVE-2026-14872

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

EUVD-2026-52587

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...