phpMyAdmin 5.0.2 - CRLF Injection

phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable. id: CVE-2020-11441 info: name: phpMyAdmin 5.0.2 - CRLF Injecti...

Shortcode Ninja <= 1.4 - Cross-Site Scripting

A cross-site scripting vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter. id: CVE-2014-4550 info: name: Shortcode Ninja = 1.4 - Cross-Site Scripting...

CVE-2026-72690 Attendize Attendize - Cross-Tenant Authorization Bypass

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

CVE-2026-72690

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

EUVD-2026-52762

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

CVE-2026-67352 luci-app-https-dns-proxy Stored XSS via resolver_url

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-14310

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...

CVE-2026-17853

CVE-2026-17853 concerns an inappropriate implementation in Chrome’s DevTools (Chromium) prior to 151.0.7922.72. A remote attacker who has compromised the renderer process can inject scripts or HTML into a privileged page via a crafted HTML page. Affected product/component: Chrome/DevTools in Chro...

Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned

This innovative practice full paper examines the integration of technology-enhanced tabletop exercises TTXs into computing education, focusing on cybersecurity curricula. The motivation is to better prepare students for complex, collaborative problem solving typical of incident response and IT...

Linux Distros Unpatched Vulnerability : CVE-2026-17903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTML...

CVE-2026-60113 AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-14603

The CVE concerns the WowOptin: Next-Gen Popup Maker WordPress plugin (before 1.4.38). Affected component is the REST API endpoint, where insufficient authorization allows unauthenticated users to disable all opt-in forms and insert new template-based opt-in rows into the database. This represents...

PT-2026-64223

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

CVE-2026-59862

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values.description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and...

EUVD-2026-44883

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...

CVE-2026-55723

CVE-2026-55723 betreft een injection kwetsbaarheid in de configuratie generator van de NGINX Ingress Controller. Bij configuratie via CRDs of Ingress-annotaties worden meerdere door de gebruiker beheerde velden in de gegenereerde NGINX-configuratie geschreven zonder sanering. Een geautoriseerde b...

PT-2026-60230

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform affected versions not specified Description A flaw in the AAP Gateway Envoy proxy configuration allows an unauthenticated remote attacker to bypass mTLS authentication. The non-mTLS route to EDA event streams fails ...

CVE-2026-48263

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-47994

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-47995

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerab...