CVE-2026-35222

Same vendor

• CVE-2026-48905 — Lack of input filtering leads to an XSS vector in the HTML filter code (6.1 MEDIUM)
• CVE-2026-48904 — An improper access check allows privelege escalation through the com_users group editing webservice endpoint (9.8 CRITICAL)
• CVE-2026-48903 — Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components (6.1 MEDIUM)
• CVE-2026-48902 — The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set (9.8 CRITICAL)
• CVE-2026-48901 — The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key (7.5 HIGH)

Same CWE

• CVE-2026-53474 — A flaw was found in migration-planner (9.6 CRITICAL)
• CVE-2026-52758 — Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL qu... (8.8 HIGH)
• CVE-2026-49498 — Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to e... (8.8 HIGH)
• CVE-2026-3018 — The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up t... (7.5 HIGH)
• CVE-2026-3326 — The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX ... (8.6 HIGH)