PT-2026-68643

Name of the Vulnerable Software and Affected Versions Security Optimizer versions 1.5.8 through 1.6.4 Description An IP allowlist bypass exists in the optional IP-based login restriction feature. The software fails to correctly validate requests, allowing unauthenticated users from non-allowliste...

CVE-2026-65901: Improper Neutralization of Input During Web Page Generation

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

PT-2026-63969

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description Arbitrary code injection is possible through the use of UI Designer form files. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

PT-2026-63863

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

CVE-2026-59517: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...

PT-2026-64179

Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 4.7.16 Description Cross-site scripting XSS occurs on the publicly accessible single booking view endpoint '/booking/'. The application uses React's dangerouslySetInnerHTML to render booking question form field labels...

CVE-2026-61947: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

PT-2026-63846

Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...

PT-2026-63591

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-64815: Improper Control of Generation of Code

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

PT-2026-63951

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

Command Injection

Overview @mongodb-js/connection-form is an A form for specifying information needed to connect to a MongoDB instance Affected versions of this package are vulnerable to Command Injection via the browser open command parameter in the OIDC authentication flow. An attacker can execute arbitrary shel...

CVE-2026-63265

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form...

GO-2026-6028 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) in gitea.dev

Gitea: Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939 in gitea.dev...

EUVD-2026-47781

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-56416

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dnamevaliddatstart, ...' and passes it straight to 'querydnametolower'...

USN-8586-1 libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. CVE-2026-40333 It was discovered that libgphoto2 did not properly null-terminate buffer...

CVE-2025-13146

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

CVE-2025-13146 Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

CVE-2025-13146 Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...