CVE-2026-97652: Improper Neutralization of Input During Web Page Generation

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-104470: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services...

CVE-2026-104441: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

PT-2026-104207

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Dart bindings contain an issue involving improper handling of length parameter inconsistency, which can lead to memory allocation with an excessive size value. Recommendations...

PT-2026-104181

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Improper handling of length parameter inconsistency and allocation of resources without limits or throttling in Apache Thrift Lua bindings. Specifically, the TBinaryProtocol:readMessageBegin...

PT-2026-104146

Name of the Vulnerable Software and Affected Versions Listdom: AI-powered Business Directory with Classifieds Ads Listings versions prior to 6.1.2 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. Authenticated attackers with...

PT-2026-104126

Name of the Vulnerable Software and Affected Versions Dc Woocommerce Multi Vendor versions prior to 5.0.19 Description An issue exists where authenticated attackers with vendor-level access or higher specifically those with the edit stores capability can perform SQL Injection. This occurs because...

PT-2026-104116

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.9.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the comment...

PT-2026-104120

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-104087

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfiltered html to store a payload that executes when t...

PT-2026-104080

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-104082

Name of the Vulnerable Software and Affected Versions SiteOrigin Widgets Bundle versions prior to 1.73.3 Description The SiteOrigin Widgets Bundle plugin for WordPress contains a Local File Inclusion flaw. Authenticated attackers with contributor-level access or higher can include and execute...

CVE-2026-97634: Improper Neutralization of Special Elements used in an SQL Command

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-103766: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-104465: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-85016: Improper Neutralization of Input During Web Page Generation

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

ROS-20261002-73-0153

The vulnerability of the Rsync file transfer and synchronization utility is related to errors in processing parameter length settings. Exploiting this vulnerability can allow a remote attacker to cause service failures...

PT-2026-104184

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.15 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the REQUEST URI query-parameter key, enabling t...

PT-2026-104200

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D language bindings contain multiple issues, including improper handling of length parameter inconsistency, uncaught...

CVE-2026-104442: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...