CVE-2026-18658: Improper Neutralization of Special Elements used in an SQL Command

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

PT-2026-85385

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2065 more potentially affected by CVE-2026-63670 via sanitize-html (>=2.1.0, <=2.17.5)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.0.1, =1.6.0 and more Source cves: CVE-2026-63670 Source advisory: OSV:GHSA-JXWJ-J7WR-GFRW...

EUVD-2026-57317

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision...

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom projec...

Security Bulletin: MongoDB Enterprised Advanced affected by: Open Redirect (CVE-2026-40181)

Summary There are vulnerabilities in router-1.23.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40181. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7...

Security Bulletin: MongoDB Enterprised Advanced affected by: Cross-site Scripting (CVE-2026-33916)

Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33916. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33916 DESCRIPTION: Handlebars provides the power necessary to let users build semantic...

CVE-2026-85303

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...

CVE-2026-84847

Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...

CVE-2026-84848

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-85303 WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...

CVE-2026-85303

CVE-2026-85303 affects the Booking and Rental Manager WordPress plugin by Magepeople inc. , with a Stored XSS vulnerability present in versions from unspecified through 2.7.7 . The flaw stems from improper neutralization of input during web page generation, allowing an attacker with low privilege...

CVE-2026-85303 WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...

EUVD-2026-70558

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7...

WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Booking and Rental Manager versions = 2.7.7...

EUVD-2026-70566

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-84848

The WordPress Quick Event Manager plugin (versions

CVE-2026-84848 WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-84848 WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-84847

CVE-2026-84847 affects the WordPress Quick Event Manager plugin in versions 9.17 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker with no prior access can exploit it over the network with low complexity and no user interaction. The CVSS 3.1 sco...