CVE-2026-54865 is a cross-site scripting (XSS) vulnerability affecting Podamibe Custom User Gravatar versions up to 1.0.8. This flaw involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-54864 is a high-severity vulnerability in nicashmu Post Video Players versions up to 1.165. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers.
CVE-2026-54860 is a critical vulnerability in ThemeREX Ozisti versions up to 1.1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-54858 is a critical vulnerability in ThemeREX Printy versions up to 1.13.0 involving unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.
CVE-2026-54857 is a critical vulnerability in ThemeREX Quirky versions up to 1.23 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of affected systems.
CVE-2026-54856 is a critical vulnerability in ThemeREX's RexCoin product, affecting versions up to and including 1.2.6. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.
CVE-2026-42701 is a high-severity vulnerability in YayCommerce's YayMail plugin versions up to 4.4.6. It involves PHP Object Injection due to deserialization of untrusted data, allowing a shop manager with privileges to potentially execute harmful actions. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability.
CVE-2026-27394 is a high-severity vulnerability in Jyothis Joy Eventer versions up to 0.1.1 that allows unauthenticated attackers to perform Cross Site Scripting (XSS) due to improper neutralization of input during web page generation.
CVE-2026-118085 is a high-severity vulnerability in GlobalPayments WooCommerce versions up to 1.23.3. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can impact confidentiality, integrity, and availability.
Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw in the Classic UI. The vulnerability arises from improper sanitization of the From email header during HTML reply composition. An attacker can craft an email with a malicious From header containing JavaScript, which executes when the victim replies in HTML mode with reply headers disabled. This may allow session theft or unauthorized actions. The issue is fixed in version 10.1.21.
Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw via the Content-Location MIME header in email attachments. An unauthenticated attacker can send a crafted email containing a malicious Content-Location header set to a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the embedded JavaScript executes in the victim's browser context. This vulnerability was fixed in version 10.1.21.
CVE-2026-88078 is a vulnerability in Microsoft Edge (Chromium-based) involving improper verification of cryptographic signatures. This flaw could allow an unauthorized attacker to perform spoofing attacks over a network. The issue affects versions from 1.0.0.0 up to but not including 156.0.4314.42. Microsoft has released an official fix in version 156.0.4314.42. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-88077 is an integer overflow or wraparound vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 154.0.4258.62. A high-severity fix is available in version 154.0.4258.62.
CVE-2026-96196 is a high-severity vulnerability in Microsoft Edge (Chromium-based) caused by an incomplete list of disallowed inputs. This flaw allows an unauthorized attacker to bypass a security feature over a network. The issue affects versions from 1.0.0.0 up to but not including 156.0.4314.50. Microsoft has issued an official fix in version 156.0.4314.50.
CVE-2026-96187 is a high-severity vulnerability in Microsoft Edge (Chromium-based) involving access of a resource using an incompatible type, also known as type confusion. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 155.0.4283.45. An official fix is available in version 155.0.4283.45.
CVE-2026-85899 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an authorized attacker to elevate privileges over a network. The flaw affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45. The vulnerability has a high severity rating with a CVSS score of 8.1. No known exploits are currently reported in the wild.