CVE-2026-86000

A flaw was found in Soup Sieve, a CSS selector library. An attacker can craft a malicious CSS selector that, when processed by the library, leads to excessive CPU consumption. This occurs due to a polynomial-time regular expression denial of service ReDoS vulnerability in the selector parser...

CVE-2026-85999

A flaw was found in Soup Sieve, a CSS selector library. A remote attacker can provide a specially crafted CSS selector containing long whitespace or comment runs. This can cause excessive CPU consumption during selector trimming, leading to a Regular Expression Denial of Service ReDoS by stalling...

CVE-2026-91014

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin versions prior to 5.4.2 are vulnerable to reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain parameters before they are reflected back in the page, specifically via the Loc...

CVE-2026-91014 Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

CVE-2026-91014 Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

CVE-2026-86000: Uncontrolled Resource Consumption

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/cssparser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an...

PT-2026-94386

Name of the Vulnerable Software and Affected Versions Soup Sieve versions prior to 2.9 Description An issue exists in the selector iter function within src/soupsieve/css parser.py where the raw selector is trimmed using RE WS END. Because this regular expression is anchored only at the end and us...

CVE-2026-18110 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username

Concrete CMS 9 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to t...

rabbitmq-server: RabbitMQ: Denial of Service via JMS topic exchange atom exhaustion

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated low-privilege AMQP Advanced Message Queuing Protocol user can exploit this vulnerability by creating bindings on an x-jms-topic exchange with specially crafted selector strings. This action causes an exhaustion of...

CVE-2026-88065: Exposure of Sensitive Information to an Unauthorized Actor

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

PT-2026-93125

Name of the Vulnerable Software and Affected Versions tts-be versions prior to 2.1.0 Description Broken Access Control exists across several API endpoints, including '/api/student/id/photo' and '/api/course unit/id/exchange/metadata'. By chaining these unauthenticated endpoints, a remote attacker...

OESA-2026-3762 python-soupsieve security update

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. It aims to provide selecting, matching, and filtering using modern CSS selectors. Soup Sieve currently provides selectors from the CSS level 1 specifications up through the latest CSS level 4 drafts and beyond though...

CVE-2026-90515

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/deletestud.php. Executing a manipulation of the argument selector can lead to sql injection. The attack can be launched remotely. The...

EUVD-2026-76998

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/deletestud.php. Executing a manipulation of the argument selector can lead to sql injection. The attack can be launched remotely. The...

CVE-2026-90515

A SQL injection vulnerability exists in SourceCodester School Registration and Fee System 1.0 , specifically in the file /bilal/normal/delete_stud.php. Manipulating the selector[] parameter allows a remote, unauthenticated attacker to inject SQL, with low impact on confidentiality, integrity, and...

CVE-2026-90515 SourceCodester School Registration and Fee System delete_stud.php sql injection

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/deletestud.php. Executing a manipulation of the argument selector can lead to sql injection. The attack can be launched remotely. The...

CVE-2026-90515 SourceCodester School Registration and Fee System delete_stud.php sql injection

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/deletestud.php. Executing a manipulation of the argument selector can lead to sql injection. The attack can be launched remotely. The...

CVE-2026-90515: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/deletestud.php. Executing a manipulation of the argument selector can lead to sql injection. The attack can be launched remotely. The...

PT-2026-90843

Name of the Vulnerable Software and Affected Versions SourceCodester School Registration and Fee System version 1.0 Description A remote SQL injection is possible due to improper handling of the selector argument within an unknown function in the /bilal/normal/delete stud.php file. SQL injection ...

CVE-2026-75880

An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0...