CVE-2026-65446

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

Malicious Package

Overview pfp-forms-sme-registration-ooo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview pfp-forms-mobile-sme-group-tiles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview tailwindcss-contact-forms is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-65446

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

CVE-2026-65446 WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

CVE-2026-65446

CVE-2026-65446 affects the WordPress Kali Forms plugin up to version 2.4.18, with an unauthenticated Cross Site Scripting (XSS) vulnerability reported. The connected documents specify an XSS flaw in Kali Forms

CVE-2026-65446 WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

CVE-2026-65879 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

EUVD-2026-49198

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kali Forms versions = 2.4.18...

OPENSUSE-SU-2026:21452-1 Security update for perl-YAML-Syck

This update for perl-YAML-Syck fixes the following issues: Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags reported by Paul Johnson via CPANSec, PR 213: -...

CVE-2026-65446: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

PT-2026-65324

Name of the Vulnerable Software and Affected Versions Kali Forms versions 2.4.18 and earlier Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update Kali Forms to a...

Wapiti Web Application Vulnerability Scanner 3.3.1

Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities. This is the source code release...

CVE-2026-15962

CVE-2026-15962 affects the Fluent Forms Pro Add On Pack for WordPress (all versions up to 6.2.6). It enables PHP Object Injection through deserialization of untrusted input. An authenticated attacker with Subscriber-level access or higher can inject a PHP Object, with a POP chain allowing passwor...

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962: Deserialization of Untrusted Data

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...