DRUPAL-CONTRIB-2026-181

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

CVE-2026-96758

The orval @orval/core package, prior to version 8.28.0 , is vulnerable to a code injection flaw in its form-data serializer . The root cause is a failure to escape multipart property names within generated template literals. This allows an attacker to inject ${...} expressions into OpenAPI schema...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

EUVD-2026-85408

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

EUVD-2026-38446

Plug: quadratic-time decoding of nested query/body parameters enables denial of service...

WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Calculated Fields Form versions = 5.5.1.1...

CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

CVE-2026-91809

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...

CVE-2026-91806

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...

CVE-2026-91806

A use-after-free vulnerability exists in Foxit PDF Editor/Reader 's handling of PDF form fields . The flaw is caused by embedded JavaScript accessing form-field references after the corresponding fields have been released, which can result in an application crash . No specific remediation steps, ...

EUVD-2026-85118

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...

CVE-2026-91806 Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...

CVE-2026-91809

Foxit PDF Editor/Reader is susceptible to a use-after-free vulnerability during the handling of malformed PDF form fields. The root cause is improper validation during field-name traversal , which can lead the application to access a released object. This vulnerability can result in an applicatio...

CVE-2026-91809 Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...

EUVD-2026-85154

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...

CVE-2026-91809 Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...

CVE-2026-6831

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-6831

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to a missing authorization flaw in versions up to and including 2.1.1 (specifically mentioned as 2.0.9 in several records). The root cause is the plugin's failure to properly verify user permissions before performing actions. This ...

CVE-2026-6831 Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...