33447 matches found
SvelteKit: Big remote form function payloads can cause Node process to crash
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS...
31g-form-parser (1.0.107), @aaravpos/appointment-barber-booking (>=1.0.0, <=5.0.0) +425 more potentially affected by CVE-2026-55685 via react-router (>=7.0.0, <=7.17.0)
react-router NPM version =7.0.0, =1.0.0, =1.0.1, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source cves: CVE-2026-55685 Source advisory:...
WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.6 - Content Injection vulnerability
Content Injection vulnerability discovered by NosleeP++ in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.6...
PT-2026-83108
Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.69.1 Description Insufficient validation of remote form function payload sizes allows an attacker to crash the Node process by sending excessively large payloads. Repeated exploitation of this issue leads to a...
CVE-2026-15663: Improper Neutralization of Special Elements used in an SQL Command
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
PT-2026-67480
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS...
PT-2026-67475
If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...
CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65901
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65901
DOMPurify 3.4.6 has a cross-site scripting vulnerability in IN_PLACE mode where attacker-controlled nodeName on live non-form nodes can cause scripts to execute when the sanitized tree is inserted into a live document. Attackers can supply hostile live DOM objects with real script children whose ...
CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65540
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
CVE-2026-61947
Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...
CVE-2026-59517
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
CVE-2026-64815
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...
CVE-2026-64815
JetBrains IntelliJ IDEA is affected by CVE-2026-64815 for versions prior to 2026.2. The vulnerability allows arbitrary code injection via UI Designer form files. Root cause details are not provided in the supplied documents, but the weakness enables code execution under certain conditions, as ind...
