EUVD-2026-85564

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77394

OpenC3 COSMOS versions 5.0.6 through 7.3.0 are vulnerable to a stored, cross-user XSS via the Telemetry screen BUTTON widget. An authenticated actor with system_set permissions can store a screen via POST /openc3-api/screen containing a button action. The application fails to sanitize this input,...

CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-76648

The Red Hat Ansible Automation Platform 2.7 (and its automation-controller) is vulnerable to a missing authorization check in the CopyAPIView component (located at awx/awx/api/generics.py:873). While the get() handler performs explicit read permission checks, the post() handler (lines 1001–1010) ...

EUVD-2026-85485

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94680 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94680

The The Post Grid WordPress plugin, versions

CVE-2026-94671 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

EUVD-2026-85483

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94671

The The Post Grid WordPress plugin, version 7.9.5 and below , is affected by a Contributor Cross Site Scripting (XSS) vulnerability. While the specific root cause and affected functions are not detailed in the provided documents, the vulnerability allows for XSS execution within the context of a ...

CVE-2026-94671 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-96652

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

SUSE CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

DRUPAL-CONTRIB-2026-160

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs. The module does not sufficiently...

EUVD-2026-85367

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96652

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to Server-Side Request Forgery (SSRF) via the /player/timeline endpoint. An attacker who possesses any valid X-Plex-Token can manipulate the protocol parameter to include a full URL, forcing the server to perform a POST request to a ...

CVE-2026-96652 Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96652 Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin The Post Grid versions = 7.9.5...