EUVD-2026-80180

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) via the icn parameter in all versions up to and including 2.15.22 . The root cause is insufficient input sanitization and output escaping. An unauth...

CVE-2026-11996

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-80100

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-11996 Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-86108

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

CVE-2026-86108

CVE-2026-86108 is an OS command injection (CWE-78) in Arista VeloCloud Edge (formerly VeloCloud Edge by Broadcom), caused by insufficient validation of inputs in management and configuration workflows. An authorized attacker with a compromised VeloCloud Orchestrator or valid management credential...

EUVD-2026-80092

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

CVE-2026-86108 Security Advisory 0181

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

EUVD-2026-80038

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSsetcgi.c and related ddnsProc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments...

PT-2026-93362

Name of the Vulnerable Software and Affected Versions WTV676-HB6035 Web Interface versions prior to V3.94 WTV776-HB6035 Web Interface versions prior to V4.17 Description Devices fail to properly validate input received from backend services. This flaw allows an unauthenticated remote attacker to...

CVE-2026-51990

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

CVE-2026-51990

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

Huawei HarmonyOS Out-of-Bounds Write Vulnerability (CNVD-2026-37863)

Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei HarmonyOS has a boundary-crossing write vulnerability. This vulnerability arises from the rendering and synthesis modules failing to correctly verify the length of the inpu...

CVE-2026-20237: Improper Input Validation

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

Huawei HarmonyOS/EMUI denial-of-service vulnerability

Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei EMUI is an emotional operating system developed by Huawei based on Android. Huawei HarmonyOS/EMUI has a denial-of-service vulnerability, which stems from a denial-of-servic...

PT-2026-93266

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

GitLab 15.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-13210)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...