WordPress AI ANN PHP Object Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress AI ANN suffers from a PHP object injection vulnerability. This vulnerability stems from improper handling of user input by the deserialization module, allowing attackers to inject...

CVE-2026-47705 TypeBot vulnerable to CSV injection in result export

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later execute...

CVE-2026-56619 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619

CVE-2026-56619 affects HCL BigFix Mobile. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient validation and output encoding of user-controlled input. The CVSS v3.1 base score is 5.4 (Medium) with Network attack, Low attack complexity, Privileges Required: Low...

UBUNTU-CVE-2026-68418

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

EUVD-2026-55226

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

K000162837: PHP vulnerability CVE-2026-7259

Security Advisory Description In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability ...

CVE-2026-12071

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

EUVD-2026-54430

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

CVE-2026-12071

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of breadcrumbs in the page list view. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious input into the breadcrumb display. Details Cross-site...

IBM Langflow OSS code injection vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a code injection vulnerability. This vulnerability arises from improper handling of user input code, resulting in inadequate control over inputs. Attackers can exploit this...

IBM Langflow OSS path traversal vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a path traversal vulnerability. This vulnerability arises from the use of user-provided knowledge base names directly for creating file paths. Without proper cleaning or check...

CVE-2026-70440

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

CVE-2026-16022 Command Injection in @oblique/cli

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

EUVD-2026-53197

imagecli's scale pipeline operation Scale::apply in src/imageops.rs computes output width/height as dimension as f32 ratio as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. A large ratio e.g. 100000 causes an...

PT-2026-68294

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper control of user input code allows a remote attacker to inject and execute arbitrary code on the system. Recommendations Update IBM Langflow OSS to a version later than 1.10.3...

CVE-2026-70372

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

EUVD-2026-52672

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation. When Line contains itemcallnumber and t...