EUVD-2026-69870

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

CVE-2026-12865

The Photo Gallery by 10Web WordPress plugin, in versions prior to 1.8.44 , is vulnerable to Reflected XSS because it fails to escape two request parameters before reflecting them into input-attribute values on its admin pages. Specifically, the sinks are located on the Shortcode page and the Gall...

CVE-2026-12865 Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

CVE-2026-84441

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84441

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84441

Piwigo versions up to 16.3.0 are affected by a path traversal vulnerability in the Image Derivative Handler component, specifically in the file i.php . The vulnerable functionality is described as unknown, but manipulation of it allows an unauthenticated remote attacker to traverse the filesystem...

EUVD-2026-69819

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84441 Piwigo Image Derivative i.php path traversal

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84441 Piwigo Image Derivative i.php path traversal

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84715 FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enablin...

SUSE CVE-2026-83605

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-84441: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

V8 JavaScript DoS

The V8 JavaScript script handler vulnerability in Google Chrome and Microsoft Edge web browsers is related to buffer overflow. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

CVE-2026-12865: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

CVE-2026-78151: Exposure of Sensitive Information to an Unauthorized Actor

The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and...

CVE-2026-19719: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

Google Chrome V8 DoS

The V8 JavaScript script handler vulnerability in Google Chrome is related to improper code generation management. Exploitation of this vulnerability allows a remote attacker to cause a denial of service by using a specially crafted HTML page...

PT-2026-84604

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

PT-2026-84866

Name of the Vulnerable Software and Affected Versions Reader Tools PDF Reader App version 98.8 Description A path traversal issue exists within the File Handler component. This occurs when the display name argument is manipulated in the ActSplashNew.handleDeeplink function, allowing a local...

CVE-2026-84852: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...