WordPress JoomSport <5.2.8 - SQL Injection

WordPress JoomSport plugin before 5.2.8 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operation...

CLSA-2026-1793372754 TuxCare security update for league/commonmark (3 CVEs)

TuxCare rebuilt league/commonmark to address 3 CVEs. Fixed in 1.6.7-p7+tuxcare...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-113713

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

PT-2026-133280

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-118192

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-112682

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-118192: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

PT-2026-130688

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

League/commonmark: Denial Of Service Via Colliding Heading Slugs

Impact "UniqueSlugNormalizer::normalize" makes each slug document-unique by searching for an unused numeric suffix, but restarts that search from "1" on every collision. The k-th heading that collapses to the same base slug performs k−1 array lookups, so K colliding slugs cost Σk−1 = OK². An...

VulnCheck KEV: CVE-2025-7721

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the...

CLSA-2026-1791742447 TuxCare security update for league/flysystem (1 CVE)

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.1.10-p2+tuxcare...

CLSA-2026-1791742369 TuxCare security update for league/flysystem (1 CVE)

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.0.70-p2+tuxcare...

PT-2026-120892

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.0.70-p2+tuxcare...

PT-2026-120893

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.1.10-p2+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-105830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's...

Linux Distros Unpatched Vulnerability : CVE-2026-105829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml...

DEBIAN-CVE-2026-105829

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...

DEBIAN-CVE-2026-105830

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...