CVE-2026-108116 is a high-severity vulnerability in Progress Software Kendo UI for jQuery versions from 2014.2.716 up to but not including 2026.3.1015. It involves improper neutralization of special elements in output used by a downstream component, specifically in the PivotGrid XMLA transport. This flaw allows specially crafted filter values to alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
CVE-2026-76182 is a medium severity vulnerability in Eclipse Jetty where the TryPathsHandler and TryFilesFilter components improperly handle URI path characters when forwarding requests to template URIs. This causes reserved characters in URI queries to be misinterpreted as multiple query parameters instead of a single parameter value.
The Email Customizer for WooCommerce (Pro) WordPress plugin versions up to and including 3.9.5 contains a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary PHP code on the server. This occurs due to insufficient authorization and input sanitization in the send_test_mail() function, enabling user-controlled PHP code to be written to executable files in the uploads directory. Exploitation can lead to full site compromise.
CVE-2026-97315 is a vulnerability in the Responsive Blocks WordPress plugin before version 2.3.0. It allows unauthenticated users to inject arbitrary HTML into notification emails sent to site owners via the Form block. This occurs because some submitted values are not properly sanitized or escaped before inclusion in the email content.
CVE-2026-88094 is a high-severity vulnerability in Microsoft Azure Storage Library's azure-storage-blob-batch component. It involves improper neutralization of special elements in output used by a downstream component, classified as CWE-74 Injection. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability affects versions from 1.0.0 up to but not including 12.31.2 and 153.0.4234.46. An official fix is available, and Microsoft has released patches for the affected versions. There are no known exploits in the wild at this time.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a code injection vulnerability in the MVG decoder when using a PostScript renderer. An attacker can craft a malicious MVG file that injects code into the PostScript rendering process. This vulnerability is identified as CVE-2026-109275 and has a medium severity rating with a CVSS score of 6.3.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is vulnerable to arbitrary shortcode execution in all versions up to and including 6.3.1. This occurs because the plugin inserts a user's display_name into page markup without filtering, then processes it with do_shortcode(). Since display_name can be modified by any user on their own account, authenticated users with Subscriber-level access or higher can execute arbitrary shortcodes. If the page displays user collections, the shortcode executes for every visitor, including unauthenticated ones.
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
CVE-2026-102156 is a vulnerability in Arista Networks CloudVision CUE involving improper neutralization of LDAP authentication input. This flaw could allow an unauthenticated network attacker to inject LDAP queries under complex conditions. The vulnerability affects versions from 2021.2.0 through 2026.2.0. It has a CVSS v3.1 score of 6.8, indicating medium severity. No known exploits are reported in the wild, and no patch information is currently provided.
CVE-2026-102158 is a medium severity vulnerability in Arista Networks CloudVision CUE where improper validation of certain API request parameters allows an authenticated network user to perform SQL injection attacks against the backend. This vulnerability impacts the availability of the backend system but does not affect confidentiality or integrity. It affects versions from 2022.2.0 through 2026.2.0 inclusive. No known exploits are reported in the wild, and no patch information is provided in the available data.
CVE-2026-105800 is a Server-Side Request Forgery (SSRF) vulnerability in the i18next-http-backend library. It occurs when an attacker controls the language or namespace input that is interpolated into the loadPath template, allowing injection of a colon character that causes the backend to request an unintended origin. This vulnerability affects versions of i18next-http-backend prior to 4.0.2 and was caused by an incomplete patch for a previous related vulnerability. The issue is fixed by rejecting colon characters in language and namespace values and ensuring URLs remain within the intended origin.
CVE-2026-82989 is a critical input injection vulnerability in the vCast network services of ViewSonic ViewBoard devices. It allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints. This flaw affects versions from 0.0.0 up to and including 3.2.715. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability.
A vulnerability in the All in One SEO WordPress plugin before version 5.0.2.1 allows unauthenticated users to execute arbitrary shortcodes. This occurs because the plugin does not properly identify which shortcodes are present in user-derived content before deciding which to strip. On sites upgraded from older versions, the protection is completely disabled, making exploitation possible without crafted input.
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
The Events Calendar WordPress plugin versions from 6.12.0 up to but not including 6.17.5.1 contain a vulnerability where unauthenticated users can submit data to an AJAX action that is not properly validated or sanitized. This flaw allows execution of arbitrary shortcodes registered on the site, potentially leading to limited confidentiality and integrity impacts. The issue is fixed in version 6.17.5.1.
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.