WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

CVE-2026-68184

A flaw was found in the Linux kernel's CD-ROM cdrom driver. When handling the CDROMVOLCTRL command, the mmcioctlcdromvolume function can perform an incorrect calculation of buffer length after a pointer adjustment. This leads to a stack out-of-bounds read, where 8 bytes of data beyond the intende...

CVE-2016-20097

CVE-2016-20097 affects Weaver (Fanwei) E-cology 8.0. A SQL injection vulnerability in the SignatureDownLoad servlet lets unauthenticated remote attackers inject a UNION SELECT payload via the markId parameter, concatenated unsanitized into a SQL query, enabling retrieval of files by steering the ...

EUVD-2016-10910

Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...

CVE-2016-20097 Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad

Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...

PT-2026-70800

Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...

UBUNTU-CVE-2026-68184

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

CVE-2026-68184 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

CVE-2026-68184

The CVE-2026-68184 issue affects the Linux kernel CD-ROM code, specifically mmc_ioctl_cdrom_volume for CDROMVOLCTRL. A 32-byte stack buffer is used to read the audio control mode page (buflen 24, then extended if a block descriptor is present). The function later builds a MODE SELECT payload by m...

EUVD-2026-55285

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the URBDRC client used server-supplied interface numbers as array indices without bounds checks, resulting in a out-of-bounds read in libusbudevselectinterface. This vulnerability has been fixed in version...

CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

CVE-2026-19351

Technical details for CVE-2026-19351 are not publicly available in the provided documents; monitor for updates.

EUVD-2026-54205

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed...

CVE-2026-16620

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed...

CVE-2026-16620 WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed...

CVE-2026-16620

The CVE details describe a vulnerability in the WPC Name Your Price for WooCommerce WordPress plugin up to version 2.2.5. In Select pricing mode, the plugin does not enforce the server-side price allowlist for configured products, allowing an unauthenticated visitor to add a product to the cart a...

CVE-2026-18992

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

CVE-2026-18325

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18992

The CVE concerns zhayujie CowAgent, specifically the Self-Evolution Review Agent, where the vulnerability affects the function _select_tools in agent/evolution/executor.py. Affects CowAgent up to version 2.1.1. The root cause is a manipulation that leads to incorrect authorization, enabling a rem...