CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not...

CVE-2026-16066

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-18474 WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

EUVD-2026-57077

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

PT-2026-71344

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

PT-2026-71002

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

PT-2026-71026

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

PT-2026-71199

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user with developer-role permissions could escalate privileges. This occurs due to improper sanitization of HTML content rendered within a CI job moda...

CVE-2026-72781

creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:12+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...

CVE-2026-48813

Vulnerability summary (CVE-2026-48813) : Flawfinder (C/C++ static analysis tool) versions prior to 2.0.20 are affected by improper input neutralization causing output manipulation. Specifically, untrusted inputs (filenames, categories, code context) can introduce Terminal/ANSI Escape Sequence Inj...

CVE-2026-62900

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-57104

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network...

bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The LDAPStoreHelper implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying...

EUVD-2026-56184

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

.NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-69109

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

CVE-2026-69109

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

CVE-2026-69109

Siemens License Server (SLS) is affected across all versions

CVE-2026-69109

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

EUVD-2026-56126

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...