CVE-2026-19944: Improper Neutralization of Special Elements used in an SQL Command

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-77187: Improper Neutralization of Input During Web Page Generation

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-19778: Improper Neutralization of Special Elements used in an SQL Command

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

SAP NetWeaver Information Disclosure (3750721)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an information disclosure vulnerability as referenced in SAP Security Note 3750721: - SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to...

Adobe Experience Manager 6.5.0 < 6.5.3 / 2026.7.0 < 2026.8.0 Multiple Vulnerabilities (APSB26-98)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.8.0, 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-98 advisory. - Critical XXE in Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1 and tika-parsers...

WatchGuard FireWare OS epm connect Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Endpoint Protection Manager service. The issue results from the lac...

CVE-2026-19797: Improper Neutralization of Input During Web Page Generation

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

CVE-2026-77186: Improper Neutralization of Input During Web Page Generation

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-85978: Improper Control of Generation of Code

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates...

PT-2026-88894

An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5...

PT-2026-88792

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2026-89269

Name of the Vulnerable Software and Affected Versions Sidebar Manager Light versions prior to 1.19 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the sbm descripti...

PT-2026-88937

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates...

HPESBNW05130 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking ClearPass Policy Manager (CPPM)

Potential Security Impact: Remote: Code Execution, Denial of Service DoS, Unqualified Configuration Change SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba ClearPass Enterprise Software See the Affected Products section for version details. Aruba ClearPass Policy Manager See...

PT-2026-88887

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-69608

Composer arbitrary command execution via a malicious package's Perforce source URL...

Malicious code in @aspect-adv-ui/consent-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...

MAL-2026-16050 Malicious code in @aspect-adv-ui/consent-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...

CVE-2026-86464

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager IdM deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL...