EUVD-2026-53965

Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...

CVE-2026-65551

CVE-2026-65551 concerns the WordPress WordPress Breakdance plugin (versions up to and including 2.6.1) where a Broken Access Control / Missing Authorization flaw exists. The root cause is incorrectly configured access control levels, enabling unauthorized actions due to insufficient restriction o...

MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting

paintballrefjosh/MaNGOSWebV4 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php step parameter, letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL id: CVE-2017-6478 info: name: MaNGOSWebV4...

NocoBase - SQL Injection

NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...

GTranslate < 2.8.65 - Cross-Site Scripting

In the Pro and Enterprise versions of GTranslate 2.8.65, the gtranslaterequesturivar function runs at the top of all pages and echoes out the contents of $SERVER'REQUESTURI'. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable ...

Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)

Pulse Secure Pulse Connect Secure PCS 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 contain a reflected cross-site scripting caused by insufficient sanitization on the Application Launcher page, letting attackers execute scripts in the context of the affected page, exploit requires victim to visit ...

CVE-2026-71312

Summary of CVE-2026-71312 : In rclone (pre-1.75.0), the code path in backend/sftp/sftp.go interpolates remote SFTP paths into PowerShell hash commands and uses quoteOrEscapeShellPath that escapes only ASCII apostrophes. This can allow an attacker-controlled filename to terminate the path literal ...

CVE-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70430

CVE-2026-70430 affects Jenkins up to version 2.575 (non‑LTS) and 2.568.1 LTS. The root cause is that the project naming strategy configuration allowed instantiating arbitrary object types without restricting them, enabling attackers with Overall/Manage permission to instantiate configuration‑rela...

CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

Stored XSS vulnerability in summary_report

summaryreport 1.15 and earlier does not escape the job name in a JavaScript context in build report pages. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission. As of publication of this advisory, there is no fix...

Users with Overall/Manage permission can instantiate any types related to configuration

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration. This allows attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

CVE-2026-46334 OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

CVE-2026-45103

OpenSIPS vulnerable to SIP message smuggling via TCP Content-Length overflow. In versions &lt; 3.6.6 and

CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution

CWP Control Web Panel 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the ttotal parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username. id: CVE-2025-48703 info:...