CVE watch

CVE-2026-103117 published: A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. ...

CVE-2026-103321 published: MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img ...

CVE-2026-27085 published: Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

CVE-2026-102385 published: Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

CVE-2026-102386 published: Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.

CVE-2026-102395 published: Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

CVE-2026-102396 published: Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

CVE-2026-102398 published: Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

CVE-2026-102399 published: Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

CVE-2026-103115 published: A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possibl...

CVE-2026-102384 published: Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.

CVE-2026-100508 published: Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

CVE-2026-100513 published: Contributor Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.5 versions.

CVE-2026-100507 published: Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic Content Personalization <= 1.10.1 versions.

CVE-2026-87830 published: In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected sign...

CVE-2026-88920 published: An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recomm...

CVE-2026-62146 published: A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-...

CVE-2026-85532 published: Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimu...

CVE-2026-103012 published: Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even ...

CVE-2026-103114 published: A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables le...