CVE-2026-54383: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated…

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using...

CVE-2026-101165: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the…

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment...

CVE-2026-118983: Unknown VikWidgetsLoader: The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before…

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post,...

CVE-2026-54372: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation…

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that...

CVE-2026-121632: Cross-site Scripting (XSS)

Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. processattrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped...

CVE-2026-108068: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one…

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer...

CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-118513: sensiolabs symfony: Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to…

Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to...

CVE-2026-76893: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...

CVE-2026-86041: mayswind ezbookkeeping: ezBookkeeping is an open source, self-hosted personal finance application

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-57562: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe...

CVE-2026-122133: mistralai mistral-vibe: Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute…

Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at...

CVE-2026-57853: DataGerry: DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with…

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja...

CVE-2026-63655: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

CVE-2026-118403: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before…

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total...

CVE-2026-122126: resiprocate: reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader() that…

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the...

CVE-2026-106554: FasterXML jackson-dataformat-cbor: One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time…

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

CVE-2026-122129: CESNET ipfixcol2: CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that…

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::readstartheader that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes...

CVE-2026-122054: The GNU C Library glibc: Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU…

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang...

CVE-2026-122140: germondai trawl: Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback...