BIT-NGINX-GATEWAY-FABRIC-2026-66362 NGF vulnerability

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

CVE-2026-81798

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...

CVE-2026-62653

A vulnerability in Reyrolle 7SR5 (all versions prior to V2.70 ) allows an unauthenticated attacker with physical access to trigger a memory corruption condition. The flaw lies in improper validation of input received over a proprietary communication protocol that is only exposed when the device i...

Improper Input Validation

Micrometer is vulnerable to improper input validation. The vulnerability is due to the use of untrusted, non-normalized input for metric names, tag keys, and tag values, which allows an attacker to supply malicious or unexpected metrics data and potentially cause security or operational issues in...

EUVD-2026-72657

A vulnerability has been identified in Desigo CC ClickOnce Client V6 All versions, Desigo CC ClickOnce Client V7 All versions, Desigo CC family V8 All versions, Desigo CC family V9 All versions, Desigo CC Flex Client V6 All versions, Desigo CC Flex Client V7 All versions, Desigo CC Installed Clie...

CVE-2026-34223

Siemens Desigo CC clients (ClickOnce V6/V7, family V8/V9, Flex V6/V7, and Installed V6/V7, all versions) are affected by a Client Code Execution (CCE) vulnerability caused by insufficient input validation when processing scripts embedded in user-defined graphics documents. An attacker who crafts ...

CVE-2026-34223

A vulnerability has been identified in Desigo CC ClickOnce Client V6 All versions, Desigo CC ClickOnce Client V7 All versions, Desigo CC family V8 All versions, Desigo CC family V9 All versions, Desigo CC Flex Client V6 All versions, Desigo CC Flex Client V7 All versions, Desigo CC Installed Clie...

K000163240: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-65183 Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

EUVD-2026-72648

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...

CVE-2026-81798

WordPress Easy Appointments plugin (versions up to and including 4.0.2.1 ) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The CVSS 3.1 score is 7.1 (HIGH) , with a network attack vector, low complexity, no privileges ...

CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...

CVE-2026-81798 WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

CVE-2026-44766

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

CLEANSTART-2026-LK25174 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the istio package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-RE39938 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the istio package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CVE-2026-76967 Insecure Deserialization in SAP NetWeaver Business Client

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...