CVE-2026-96743

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-96743 Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-96743

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.1-RC2 . The root cause is insufficient input sanitization and output escaping of Table Field Values. This allows authenticated attackers with subscrib...

EUVD-2026-96036

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CLEANSTART-2026-JM42748 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1

Security vulnerability affects the apache-nifi package. Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1...

CVE-2026-96743: Improper Neutralization of Input During Web Page Generation

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-108623: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire syslog table,...

CVE-2026-78068: Improper Neutralization of Input During Web Page Generation

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Linux Distros Unpatched Vulnerability : CVE-2026-105830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's...

iOS26.6-CVE-2026-64788

CVE-2026-64788 — IOGPUFamily Use-After-Free Component: IOGPUFamily kernel extension com.apple.iokit.IOGPUFamily Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Use-After-Free in IOGPUDevice::createresourceiosurface Impact: Kernel memory corruption; UAF...

EUVD-2026-95981

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

Malicious Package

Overview @brick-v2/table is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-107834

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) is vulnerable to resource exhaustion due to improper file handle management in the internal/bodyprocessors/multipart.go component. The multipart loop executes defer temp.Close() for every uploaded file part, preventing descriptors from ...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

CVE-2026-107815

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

CVE-2026-107815

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

WordPress Table Field Add-on for ACF and SCF plugin <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Table Field Add-on for ACF and SCF versions = 1.3.35...

WordPress Table Field Add-on for ACF and SCF plugin < 1.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Table Field Value vulnerability discovered by Kuba in WordPress Plugin Table Field Add-on for ACF and SCF versions 1.4.1...

EUVD-2026-95909

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

Malicious code in @brick-v2/table (npm)

Source: amazon-inspector 1fdd2bc5b913543c62603b366fb4e1261407f63541e4b01ff7e0052e522523e0 @brick-v2/table presents a trivial Angular-style logger/table shim forRoot/createLogger/version no-ops while index.js unconditionally side-loads prebuilds/-/metrics.node on require. The native addon reads...