SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

phptopwn

PHP2Shell Threat-Intelligence Honeypot A safe, high-interacti...

CVE-2026-115479

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties...

CVE-2026-115480

The baserCMS website development framework (versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 ) contains a vulnerability where the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint fails to enforce the auth_captcha setting. The root cause is that BcMail Controller Ap...

CVE-2026-115480 baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

CVE-2026-115479 baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties...

CVE-2026-115479

The website development framework baserCMS is vulnerable in versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2 due to improper input validation in public mail forms. An unauthenticated visitor can provide a comma-separated list of addresses in an email field, which the MailMessageMailer::sendForm...

EUVD-2026-108986

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties...

CVE-2026-115479 baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties...

CVE-2026-93630

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to a hostname canonicalization issue in their email HTML sanitizers. The DefangFilter and OWASP ActionAttributePolicy components fail to properly handle percent-encoded hostnames, comparing them against the request h...

CVE-2026-94267

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-110510

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-94264

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins (versions before 0.9.2.8 ) are vulnerable to Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape certain form shortcode attributes , which can be manipulated using values fro...

EUVD-2026-108604

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-94267

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins, in versions prior to 0.9.2.8 , are vulnerable to unauthenticated Remote Code Execution (RCE) . The root cause is a lack of capability checks when updating a post via front-end form actions. An unauthe...

CVE-2026-94267 Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-94264 Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...

EUVD-2026-108595

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's,...

EUVD-2026-108590

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-110510

The Essential Addons for Elementor WordPress plugin (versions before 6.8.7 ) contains a content injection vulnerability. The plugin fails to validate the HTML tag setting of certain widgets during markup generation. This allows users with author privileges or higher to inject iframe and form elem...