1673 matches found
SUSE CVE-2026-30246
Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key...
PT-2026-70927
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
Prototype Pollution
Axios is vulnerable to prototype pollution. The vulnerability is due to nested request option objects being read without validating own properties, which allows an attacker to exploit pre-existing Object.prototype pollution to inject inherited authentication values or alter query-string...
CVE-2026-15256
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
CVE-2026-15256
The CVE affects the Ninja Forms WordPress plugin (pre-3.14.10). The issue arises because user-supplied query-string input used to pre-populate a field’s default value is not filtered and can be processed as a shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes registered...
CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
PT-2026-68654
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
CVE-2026-15256: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...
EUVD-2026-53361
Magistrala formerly Mainflux's message-readers API reads a format value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: fmt.Sprintf"SELECT FROM...
Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for July 2026.
Summary Security vulnerabilities are addressed with IBM Business Automation Insights 24.0.0-IF008, 25.0.0-IF006 and 26.0.0-IF001. These vulnerabilities have been also adressed in 24.0.1-IF008. Vulnerability Details CVEID:CVE-2026-8723 DESCRIPTION: Summary qs.stringify throws TypeError when called...
Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers July 2026
Summary In addition to updating many operating system level packages, IBM Business Automation Workflow container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated valu...
CVE-2026-15452: Improper Neutralization of Input During Web Page Generation
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-52747
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...
CLSA-2026-1784769609 TuxCare security update for qs (3 CVEs)
TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.7.0-tuxcare.2...
GHSA-9WX3-P993-35VP Duplicate Advisory: Axios: Nested axios option objects can consume polluted prototype values
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q8q-rj6j-mhjq. This link is maintained to preserve external references. Original Description axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when th...
CVE-2026-67319
axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...
CVE-2026-67319
axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...
CVE-2026-67319
Axios before 0.33.0 (and 1.x before 1.18.0) is vulnerable to prototype pollution via nested request option objects. When Object.prototype is polluted, nested plain objects (e.g., auth, paramsSerializer) are cloned into ordinary objects and read without own-property checks, potentially injecting a...
CVE-2026-67329: Authorization Bypass Through User-Controlled Key
@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...