CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-95866

The User Profile Builder plugin for WordPress (versions up to and including 4.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field . The root cause is insufficient input sanitization and output escaping in the wppb_save_avatar_value() function, where a zero-length multipa...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-93897

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.27 . The root cause is insufficient input sanitization and output escaping of the first_name parameter. This allows unauthenticated attackers to inject arbitrary ...

CVE-2026-79251

A flaw was found in Google Chrome. Improper input validation in the Network component allows a remote attacker to potentially bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page. The web origin policy is a critical security mechanism that...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

OESA-2026-4104 rubygem-mail security update

A really Ruby Mail handler. Security Fixes: Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through qvaluedecode and bvaluedecode in lib/mail/utilities.rb. An attacker can make a display name or local part decode to a different address tha...

OESA-2026-4048 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4049 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4046 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

OESA-2026-4047 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...

CVE-2026-96874: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

The vulnerability of the Erlang/OTP software platform, related to copying buffers without checking the size of the input data, allows a hacker to trigger a service failure.

The vulnerability of the Erlang/OTP software platform lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-98977

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-94445: Improper Input Validation

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-67234: Improper Input Validation

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

PT-2026-98874

Name of the Vulnerable Software and Affected Versions Input Leap versions prior to 3.0.4 Description When the non-default --enable-drag-drop option is active on Windows or macOS, the software mishandles the distinction between forward slashes / and backslashes . This flaw allows directory travers...

CVE-2026-100230: Incorrect Behavior Order: Validate Before Canonicalize

Input Leap aka input-leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message...