CVE-2026-55015

CVE-2026-55015 is an uncontrolled search path element vulnerability in Windows Remote Help that allows an authorized local attacker to cause a denial of service . The attack requires local access with low privileges and no user interaction (CVSS 3.1: 5.5 MEDIUM ). CISA's SSVC assessment indicates...

CVE-2026-55013

An uncontrolled search path element in Windows Remote Help Defense allows an authorized local attacker (low privileges, no user interaction) to spoof, with HIGH confidentiality and integrity impact per CVSS 3.1 (base score 7.1). Microsoft's update guide is the primary reference. No exploit code o...

CVE-2026-55769

CloudNativePG (a Kubernetes operator for PostgreSQL) is vulnerable to privilege escalation to superuser in versions prior to 1.28.4 and 1.29.2 . The root cause is that superuser connections in fillDefaultParameters (pkg/management/postgres/pool/profiles.go) did not pin search_path. An attacker wi...

CVE-2026-52021

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

Windows Remote Help Defense Spoofing Vulnerability

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally...

Microsoft Remote Help Denial of Service Vulnerability

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally...

CVE-2026-66607

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

EUVD-2026-63294

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66607 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66607

The WordPress Advance Product Search plugin (versions ≤ 1.4.8) has an unauthenticated XSS flaw with CVSS 7.1 (HIGH). Patchstack is the source; the Patchstack advisory link is provided in the references. No exploitation evidence is reported in the provided documents.

CVE-2026-76569

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

EUVD-2026-63211

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

EUVD-2026-62961

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...

EUVD-2026-62964

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

EUVD-2026-62956

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

EUVD-2026-62953

In Splunk Enterprise Security versions below 8.6.1, a user who holds the essanalyst Splunk Enterprise Security role could change User and Entity Behavior Analytics UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system...

EUVD-2026-62952

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

EUVD-2026-62915

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...