WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin W4 Post List versions = 3.0.6...

CVE-2026-94680

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94671

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

EUVD-2026-85564

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77394

OpenC3 COSMOS versions 5.0.6 through 7.3.0 are vulnerable to a stored, cross-user XSS via the Telemetry screen BUTTON widget. An authenticated actor with system_set permissions can store a screen via POST /openc3-api/screen containing a button action. The application fails to sanitize this input,...

CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-76648

The Red Hat Ansible Automation Platform 2.7 (and its automation-controller) is vulnerable to a missing authorization check in the CopyAPIView component (located at awx/awx/api/generics.py:873). While the get() handler performs explicit read permission checks, the post() handler (lines 1001–1010) ...

EUVD-2026-85485

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94680 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94680

The The Post Grid WordPress plugin, versions

CVE-2026-94671 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94671 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

EUVD-2026-85483

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94671

The The Post Grid WordPress plugin, version 7.9.5 and below , is affected by a Contributor Cross Site Scripting (XSS) vulnerability. While the specific root cause and affected functions are not detailed in the provided documents, the vulnerability allows for XSS execution within the context of a ...

CVE-2026-96652

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

SUSE CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

DRUPAL-CONTRIB-2026-160

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs. The module does not sufficiently...

EUVD-2026-85367

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...