CVE-2026-118404: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a…

The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products,...

CVE-2026-110692: Unknown: The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate…

The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks...

CVE-2026-121940: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows…

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to rea...

CVE-2026-121945: CoopCycle coopcycle-web: CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read…

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLECOURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/id/action to re-price, canc...

CVE-2026-121928: InfiniFlow RAGFlow: A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/fileutils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-121970: wphostingdev Pay with Vipps and MobilePay for WooCommerce: Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature…

Pay with Vipps and MobilePay for WooCommerce woo-vipps before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the...

PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-In-Memory Architectures

Processing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and beyond the control-flow defenses that protect host programs. The security of this in-memory code is an attack surface that remains largely unstudied. We present PIMROP, to our...

CVE-2026-54381: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows…

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881...

CVE-2026-104719: Unknown CookieYes: The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script…

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator...

CVE-2026-12538: IBM MQ Appliance: IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to…

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields...

CVE-2026-121966: traefik: Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url…

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

CVE-2026-122013: Comfast CF-WR632AX: A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attac...

CVE-2026-114627: Cross-site Scripting (XSS)

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step...

CVE-2026-13271: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to...

CVE-2026-54382: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role…

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite oth...

CVE-2026-97693: xerrors Yuxi: Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute...

CVE-2026-115250: Unknown Text Typing: The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it…

The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site...

CVE-2026-102664: sysown proxysql: ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompressmysqlpayload in lib/mysqldatastream.cpp accepts a zlib stream when uncompress returns ZOK without checking that the actual output length equals the attacker-controlled payloadlength...

CVE-2026-114424: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or…

SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derive...

CVE-2026-110282: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control...