PT-2026-113590

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-100193: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-95808: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Ahsay AhsayCBS Command Injection Vulnerability

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with...

PT-2026-113622

Name of the Vulnerable Software and Affected Versions Verified Reviews Avis Vérifiés plugin for WordPress versions prior to 2.4.7 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious...

PT-2026-113711

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and...

PT-2026-114382

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 boot process where a command line may occupy nearly the entire COMMAND LINE SIZE. In this scenario, the append ipl block parm function passes a zero size to I...

Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness

Backdoor attacks on deep neural networks are commonly evaluated by attack success rate and benign accuracy, yet their stealthiness remains inconsistently defined and measured. Existing work often studies only one observable aspect of stealthiness, such as trigger imperceptibility, feature-space...

CVE-2026-103369: Improper Neutralization of Input During Web Page Generation

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-114067

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in admin area/flagged item.php via the unencoded type GET parameter. Attackers can send crafted flagged item.php?type= links to logged-in administrators or moderators to execute injected script in the admin...

PT-2026-114069

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in admin area/index.php that allows attackers to inject HTML via the val parameter in mode=add todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-110627: Improper Neutralization of Input During Web Page Generation

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-101338: Stack-based Buffer Overflow

When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...

PT-2026-113722

Name of the Vulnerable Software and Affected Versions AmazonPay Plugin for EC-CUBE 4 series affected versions not specified Description An issue exists where an assumed-immutable web parameter is under external control. This allows an attacker to redirect users to an arbitrary website during the...

CVE-2026-107369

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...

CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...

CVE-2026-110219

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

CVE-2026-110219

QloApps versions through 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the Additional Facilities back-office form, where the price parameter fails to properly sanitize input. An attacker can craft a request containing an unescaped price value tha...

EUVD-2026-99260

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

CVE-2026-110219 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...