CVE-2026-28187

Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...

CVE-2026-28186

Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...

CVE-2026-28168

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28173

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-28170

Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...

CVE-2026-28174

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28181

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28182

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-28157

Subscriber Path Traversal in Do Lasso = 358 versions...

CVE-2026-28156

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-28155

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

CVE-2026-28149

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28159

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-28158

Unauthenticated Cross Site Scripting XSS in Do Lasso = 358 versions...

CVE-2026-28161

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-28002

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28008

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-27999

Subscriber Broken Access Control in Tourfic = 2.23.1 versions...

CVE-2026-28148

Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...

CVE-2026-28001

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-28003

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-28004

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...

CVE-2026-27544

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27543

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

CVE-2026-27539

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27537

Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.11.2 versions...

CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27535

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

CVE-2026-27536

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

CVE-2026-27380

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-19716

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-27345

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

CVE-2026-21832

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions...

CVE-2025-62314

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

CVE-2025-62315

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

CVE-2025-62318

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2026-73583

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

CVE-2026-73584

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the /tmp directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. Th...

CVE-2026-73585

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...

CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

CVE-2026-6470

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL...

CVE-2026-6469

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the...

CVE-2026-6471

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-18408

Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...

CVE-2026-19385

Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...