CVE-2026-15653: Improper Neutralization of Input During Web Page Generation

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-15718

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

CVE-2024-58353

Cal.com repository calcom/cal.diy in versions . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript th...

GO-2026-5989 Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh

When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map. An unauthenticated remote client can grow the state storage, bounded by...

CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

EUVD-2026-48313

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65760

The CVE-2026-65760 entry concerns the Joomla Easy Store extension by joomshaper.com (versions 1.0.0–2.0.1). The vulnerability is described as improper access checks that allow logged-in users to retrieve order and customer information for any order, indicating a cross-customer confidentiality lea...

Improper Check for Unusual or Exceptional Conditions

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe's...

JLSEC-2026-778

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH Secure Shell connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

GHSA-7RQJ-J65F-68WH Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

Incorrect Behavior Order: Validate Before Canonicalize

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

CVE-2026-65904

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-65912

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

MINI-G94W-3MMV-222V

Bulletin has no description...

MINI-G8MF-VVQQ-MGMV

Bulletin has no description...

CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-65904

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

EUVD-2026-48273

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...