EUVD-2026-69887

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

CVE-2026-82883 WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...

CVE-2026-81737

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-19704

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...

CVE-2026-12865

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

CVE-2026-82182

The WPvivid — Backup, Migration & Staging WordPress plugin is vulnerable to SQL injection in versions prior to 0.9.133 . The root cause is the failure to sanitize a user-supplied list of identifiers before including them in a SQL query . This vulnerability allows users with administrator privileg...

CVE-2026-82182 WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

CVE-2026-12865

The Photo Gallery by 10Web WordPress plugin, in versions prior to 1.8.44 , is vulnerable to Reflected XSS because it fails to escape two request parameters before reflecting them into input-attribute values on its admin pages. Specifically, the sinks are located on the Shortcode page and the Gall...

SUSE CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

CVE-2026-84701

NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...

EUVD-2026-69732

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

EUVD-2026-69738

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

EUVD-2026-69719

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

DEBIAN-CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-84357

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-84325

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

DEBIAN-CVE-2026-84325

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

CVE-2026-84357

An improper input validation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523208474 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produc...