CVE-2026-8911

The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2026-32274

Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the...

Cross-site Scripting (XSS)

shopware/shopware is vulnerable to cross-site scripting XSS. The vulnerability exists as the unsanitized value of the newsletter title, headline, is displayed in the description of campaignKey...

OS Command Injection

apiconnect-cli-plugins is vulnerable to OS command injection. The vulnerability exists the values of pluginUri is not sanitized and can be controlled by users...

OS Command Injection

node-key-sender is vulnerable to OS command injection. The vulnerability exists through the unsanitized value of arrParams used in exec...

SQL Injection

django is vulnerable to SQL injection. The vulnerability exists through the unsanitized value of the user-specified column delimiter in contrib.postgres.aggregates.StringAgg...

Cross-Site Scripting (XSS)

simplesamlphp/simplesamlphp is vulnerable to cross-site scripting XSS. The vulnerability exists through the unsanitized value of $this-text in Utils/EMail.php, which is subsequently rendered and executed when a browser loads www/errorreport.php...

Arbitrary Code Injection

hot-formula-parser is vulnerable to arbitrary code injection. The vulnerability exists due to the lack of sanitization of the value of yytext, which is used in the exec command...

Cross-site Scripting (XSS)

paypal/adaptivepayments-sdk-php is vulnerable to cross-site scripting XSS. The vulnerability exists in the sample application where the value of $REQUEST'payKey' was not sanitized...

CVE-2018-16146

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection wi...