20303 matches found
PT-2026-65821
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the public bookingmessage view without escaping or sanitization: p...
Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense
Enterprises are moving toward autonomous cyber defense: agentic AI that builds situational awareness of an organization's security state and reasons from it to assessments, decisions, and actions. This rests on a holistic view of the enterprise's security state, the continuous, cross-vendor pictu...
CVE-2026-7436: Improper Neutralization of Input During Web Page Generation
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...
Malicious Package
Overview text-line-parser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-67174 DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...
CVE-2026-67174
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a element through innerHTML. Strings derived from untrusted graph...
Malicious code in text-line-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...
EUVD-2026-49795
Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious...
CVE-2026-66919
Pivotick exposes a DOM-based XSS in the node inspect/edit modals. Node labels/descriptions sourced from graph data were interpolated into modal HTML, enabling injected HTML/JS to run in the victim’s origin when a node is opened. The issue is mitigated by removing graph data embedding in HTML and ...
CVE-2026-14106
An insufficient validation of untrusted input flaw was found in the Text component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513532778...
Security update for helm
This update for helm fixes the following issues: Update to version 3.21.3. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. CVE-2026-56852: golang.org/x/text/unicode/norm: handling input...
CVE-2026-15671 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-15014
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery WordPress plugin (up to version 3.9.7) is affected by an authentication bypass. The root cause is in processRegistration(), which relies on a phone-unbound $_SESSION['sa_mobile_verified'] flag as the sole gat...
CVE-2026-15014 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...
CVE-2026-51269
This CVE-2026-51269 entry is rejected/not used and does not represent an active vulnerability.
PT-2026-65510
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech function. The application accepts attacker-controlled long speech text input, performs URL encoding, and directly appends the encoded result into a fixed ps ptr heap buffer when constructing HT...
EUVD-2026-49867
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech function. The application accepts attacker-controlled long speech text input, performs URL encoding, and directly appends the encoded result into a fixed psptr heap buffer when constructing HTT...
PT-2026-65482
Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious...