CVE-2026-77115

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

CVE-2026-77115

The Brave Popup Builder (brave-popup-builder) WordPress plugin, versions

EUVD-2026-64638

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

CVE-2026-77115: Improper Neutralization of Input During Web Page Generation

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

PT-2026-79762

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-63004

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

K000163008: Next.js vulnerability CVE-2026-44574

Security Advisory Description Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query...

CVE-2026-76565

Joomla Extension - phoca.cz - Reflected XSS via pricefrom & priceto filter parameters in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76565

PhocaCart (Joomla extension by phoca.cz) versions 5.0.0–6.1.7 are vulnerable to Reflected XSS (CWE-79) via the price_from and price_to GET parameters. The root cause is that these parameters are processed with Joomla's 'string' input filter, which applies only strip_tags() without htmlspecialchar...

EUVD-2026-63210

Joomla Extension - phoca.cz - Reflected XSS via pricefrom & priceto filter parameters in Phoca Cart 5.0.0-6.1.7...

EUVD-2026-62951

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and...

PT-2026-78902

Joomla Extension - phoca.cz - Reflected XSS via price from & price to filter parameters in Phoca Cart 5.0.0-6.1.7...

JetBrains YouTrack < 2026.1.13901 / 2026.2.x < 2026.2.17950 DoS (CVE-2026-75050)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.13901, or 2026.2.x prior to 2026.2.17950. It is, therefore, affected by a denial of service vulnerability: - A DoS attack was possible via crafted type parameters. CVE-2026-75050 Note that Nessus has not tested for...

CVE-2026-76385

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

CVE-2026-76386 Information Disclosure through Action Parameters in Zoom app for Splunk SOAR

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and...

CVE-2026-76385 Information Disclosure through Action Parameters in Venafi app for Splunk SOAR

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...