CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-95586 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

EUVD-2026-85499

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

CVE-2026-95586 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

CVE-2026-95586

The Ultimate Addons for Contact Form 7 WordPress plugin (versions

CVE-2026-95529 WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...

CVE-2026-95529 WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...

CVE-2026-95529

The Calculated Fields Form plugin for WordPress is vulnerable to an unauthenticated Cross Site Scripting (XSS) flaw in versions

EUVD-2026-85497

Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...

CVE-2026-96758

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

DRUPAL-CONTRIB-2026-181

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

CVE-2026-96758

The orval @orval/core package, prior to version 8.28.0 , is vulnerable to a code injection flaw in its form-data serializer . The root cause is a failure to escape multipart property names within generated template literals. This allows an attacker to inject ${...} expressions into OpenAPI schema...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

EUVD-2026-85408

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

EUVD-2026-38446

Plug: quadratic-time decoding of nested query/body parameters enables denial of service...

WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Calculated Fields Form versions = 5.5.1.1...

CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

CVE-2026-91809

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...

CVE-2026-91806

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...