CVE-2026-95530: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-94457: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...

CVE-2026-6327: Improper Output Neutralization for Logs

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-6721: Improper Neutralization of Special Elements used in an OS Command

IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the...

CVE-2026-71465: Improper Neutralization of Argument Delimiters in a Command

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71463: Generation of Error Message Containing Sensitive Information

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...

CVE-2026-19438: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Mint Workbench I. This issue affects Mint Workbench I: through 5876...

CVE-2026-94500: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

CVE-2026-95593: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Ultimeter = 3.0.8 versions...

CVE-2026-95592: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Team = 6.0.0 versions...

CVE-2026-95522: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...

CVE-2026-95514: Authentication Bypass by Alternate Name

Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...

CVE-2026-94680: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94679: Missing Authorization

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

CVE-2026-94498: Missing Authorization

Unauthenticated Broken Access Control in AppMySite = 3.15.4 versions...

CVE-2026-94487: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94174: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Email Log = 2.63 versions...

CVE-2026-94168: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-95523: Authentication Bypass by Spoofing

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-93772: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in wpForo Forum = 3.1.5 versions...