| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. |
| Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. |
| Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions. |
| Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. |
| Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. |
| Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions. |
| Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. |
| Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. |
| Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. |
| Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. |
| Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. |
| Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. |
| Editor PHP Object Injection in Zippy <= 1.7.0 versions. |
| Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. |
| Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a valid default initializer after compilation, causing the generated JavaScript to execute in the Node.js host process. The demonstrated reachable path uses a JSON module import attribute, which prevents the malicious alias from being emitted again in a later ESM circular-import assignment and keeps the generated function syntactically valid. This incomplete fix for CVE-2026-33943 is a distinct residual path because the earlier remediation validated the local export importName path but not the named-import alias. This issue is fixed in version 21.0.4. |
| GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1. |
| NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user. |
| MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass. |
