CVE-2026-84088

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.9 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to validate or sanitize a widget link setting before it is stored and subsequently used in a JavaScript navigation call . This ...

EUVD-2026-80180

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) via the icn parameter in all versions up to and including 2.15.22 . The root cause is insufficient input sanitization and output escaping. An unauth...

CVE-2026-11996

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-80100

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-11996 Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-86108

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

CVE-2026-86108 Security Advisory 0181

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

EUVD-2026-80092

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

CVE-2026-86108

CVE-2026-86108 is an OS command injection (CWE-78) in Arista VeloCloud Edge (formerly VeloCloud Edge by Broadcom), caused by insufficient validation of inputs in management and configuration workflows. An authorized attacker with a compromised VeloCloud Orchestrator or valid management credential...

EUVD-2026-80038

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSsetcgi.c and related ddnsProc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments...

PT-2026-93282

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

PT-2026-93362

Name of the Vulnerable Software and Affected Versions WTV676-HB6035 Web Interface versions prior to V3.94 WTV776-HB6035 Web Interface versions prior to V4.17 Description Devices fail to properly validate input received from backend services. This flaw allows an unauthenticated remote attacker to...

ROS-20260916-73-0031

The vulnerability of the ufshcdqueuecommand function in the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-20237: Improper Input Validation

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-81875: Improper Input Validation

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

CVE-2026-88064: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-89207: Improper Validation of Specified Type of Input

A vulnerability has been identified in WTV676-HB6035 Web Interface All versions V3.94, WTV776-HB6035 Web Interface All versions V4.17. Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into...