CVE-2026-19619 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-78252

GitLab CE/EE versions from 15.3 before 19.1.8 , 19.2 before 19.2.6 , and 19.3 before 19.3.2 are affected by improper sanitization of user-controlled data in the Markdown JSON table renderer . Under certain conditions, an authenticated user could induce a targeted user to perform unintended state-...

EUVD-2026-80222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-85530 GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

CVE-2026-85530 GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

CVE-2026-85530

The GiveWP WordPress plugin (versions 4.16.6 through 4.16.8.0 ) is vulnerable to an unauthenticated account takeover . The root cause is an inconsistent normalization of donor email addresses between the storage and lookup processes. This discrepancy allows unauthenticated users to be resolved as...

CVE-2026-5920

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) via the icn parameter in all versions up to and including 2.15.22 . The root cause is insufficient input sanitization and output escaping. An unauth...

EUVD-2026-80111

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-11996

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-80100

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-11996 Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

PT-2026-93281

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

PT-2026-93266

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

The vulnerability of the ssdpcgi_main() function in the SSDP component of the D-Link DIR-820LW router’s microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the ssdpcgimain function in the SSDP component of the D-Link DIR-820LW router’s software lies in the lack of measures to sanitize input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

CVE-2026-18595: Improper Neutralization of Input During Web Page Generation

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails t...