CVE-2026-66294 is an XML injection vulnerability in the Saxy XML encoder used by the qcam project. The flaw occurs because the encoder's CDATA serialization does not properly handle the substring ]]> inside CDATA sections, allowing an attacker to prematurely terminate the CDATA block and inject arbitrary XML markup. This can lead to forged or overridden XML elements and attributes in documents such as SOAP envelopes, RSS/Atom feeds, sitemaps, SVG, or other XML exports that include untrusted text in CDATA nodes. Versions of saxy from 0.7.0 up to but not including 1.7.0 are affected. The issue is fixed in version 1.7.0.
CVE-2026-66295 is an XML Injection vulnerability in the qcam saxy XML encoder versions from 0.7.0 up to but not including 1.7.0. The vulnerability arises because the encoder writes processing instruction targets and content verbatim without validation or escaping, allowing attackers to inject arbitrary XML constructs. This can cause the serialized XML document to differ from the intended structure, potentially leading to forged records, injected stylesheets, or malicious content in XML or SVG outputs. The issue is fixed in version 1.7.0.
CVE-2026-66293 is an XML injection vulnerability in the Saxy encoder component of the qcam saxy library. The encoder fails to properly neutralize the '--' sequence within XML comment content, allowing an attacker to prematurely close comments and inject arbitrary sibling markup. This can lead to stored cross-site scripting (XSS) when rendered as HTML or SVG, or data forgery when processed by other XML consumers. The vulnerability affects saxy versions from 0.7.0 up to but not including 1.7.0. A fix is available starting from version 1.7.0.
A vulnerability in undici HTTP client for Node.js versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 allows a shared cache to serve an authenticated response to an unauthenticated caller due to improper origin validation during redirect and cache revalidation. This occurs when a cached response is revalidated with a 304 Not Modified status from a different origin, causing undici to incorrectly treat the response as valid. The issue is fixed in versions 7.30.2 and 8.12.4. Users should upgrade to these versions or later or apply recommended workarounds to mitigate the risk.
A vulnerability in the undici HTTP client for Node.js allows sensitive headers such as Authorization and Cookie to be exposed to unauthorized actors during cross-origin redirects when headers are supplied as an array of tuples. This bypasses intended header stripping and can disclose origin-bound credentials. The issue affects versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 and is fixed in versions 7.30.2 and 8.12.4.
undici versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3 improperly validate Subresource Integrity (SRI) metadata by splitting on a single space instead of all ASCII whitespace. This allows an attacker controlling the response body to bypass integrity checks if the integrity string contains whitespace such as tabs, leading to acceptance of tampered content without error. The issue is fixed in versions 7.30.2 and 8.12.4.
CVE-2026-33379 is a missing authorization vulnerability in Grafana OSS and Grafana Enterprise version 12.4. It allows users with any role, including those with minimal permissions such as Viewer or service accounts with no permissions, to create, externally publish, and delete dashboard snapshots. This issue affects versions from 12.4.0 up to but not including 12.4.4. The vulnerability has been fixed in version 12.4.4.
undici, an HTTP client for Node.js, has a vulnerability in versions 7.30.1 and 8.12.2 through 8.12.3 where origin validation during caching of redirected responses is flawed. This allows an attacker controlling a redirect target from a trusted URL to poison cached entries or cause private responses to be served to other users. The issue arises because the client inspects only the final redirect hop for caching decisions, ignoring intermediate hops that may affect cache validity. The vulnerability is fixed in versions 7.30.2 and 8.12.4.
CVE-2026-120222 is a vulnerability in the undici HTTP client for Node.js affecting versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3. When the cache interceptor is used with a downstream handler that throws during response processing, an asynchronous exception can escape as an uncaught exception or unhandled promise rejection, causing the Node.js process to terminate. This can be triggered by a malicious or compromised HTTP server serving a cacheable response that causes the throw on replay, including during 304 revalidation of stale cache entries. The impact is denial of service (availability). The issue is fixed in versions 7.30.2 and 8.12.4, and users are advised to upgrade to these or later versions. As a temporary workaround, avoid composing the cache interceptor with response handlers that throw until patched.
Multiple vulnerabilities affect WAGO PLCs and communication components, enabling denial-of-service conditions and arbitrary code execution via manipulated CODESYS project files. These issues threaten industrial control system integrity, confidentiality, and availability.
A vulnerability identified as CVE-2026-111497 affects SICK AG products prior to version 2026.1.3. Exploitation could allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the affected products. The issue is fixed in version 2026.1.3.
A vulnerability in undici HTTP client versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 allows cross-user disclosure of cached private responses. When using the redirect interceptor with a shared response cache, an authenticated redirected request's final response is cached under the original request's key, which lacks credential and Vary header information. This can cause private response data to be served to unauthorized users. The issue is fixed in versions 7.30.2 and 8.12.4.
The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.
The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Eventin plugin for WordPress up to version 4.1.29 has a missing authorization vulnerability that allows authenticated users with subscriber-level access or higher to retrieve email addresses and phone numbers of any WordPress user by manipulating the 'id' parameter in a query string.
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that a published page or post on the target site contains the [meta_data_filter_results] shortcode, which is the primary output feature of the plugin.
The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress suffers from a PHP code injection vulnerability in all versions up to and including 8.0.26. This flaw arises from insufficient sanitization of the feedConfigCustom2 parameter, which is passed directly to PHP's eval() function during feed generation. Authenticated users with Shop Manager-level access or higher can exploit this to execute arbitrary PHP code, potentially leading to full remote code execution and site takeover. The vulnerability is exploitable by default without additional configuration because the ctxfeed_custom2_eval_enabled option defaults to true.
The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via the WordPress core REST endpoint POST /wp-json/wp/v2/users/me, which bypasses the plugin's own wpum_sanitize_text sanitizer applied on its front-end account form, making the save-time sanitization ineffective as a mitigation.