CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-4806

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable in all versions up to and including 1.1.2 . The root cause is a missing capability check on the save_option() function, which allows unauthenticated attackers to perform unauthorized settings export or settings reset (de...

CVE-2026-4806 Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the saveoption function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in USB settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation through a crafted HTML page. Chromium security severity: Medium...

CVE-2026-82077 PaperCut NG/MF: Remote Code Execution via Scan2Fax

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

CVE-2026-82077

A path traversal vulnerability exists in the Scan-to-Fax component of PaperCut NG and PaperCut MF . An authenticated administrator can exploit this flaw by providing crafted fax provider settings to achieve arbitrary command execution on the underlying host. The vulnerability is associated with a...

CVE-2026-82077 PaperCut NG/MF: Remote Code Execution via Scan2Fax

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

firefox: thunderbird: Sandbox escape in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...

firefox: thunderbird: Mitigation bypass in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Remote Settings Client component...

PT-2026-97727

Name of the Vulnerable Software and Affected Versions Rancher affected versions not specified Description An unauthenticated attacker can perform an update of public UI settings to plant malicious content that executes in the browser of users visiting the login page. This stored Cross-Site...

PT-2026-97923

Name of the Vulnerable Software and Affected Versions Termix versions 2.4.1 through 2.5.0 Description An authenticated administrator can execute arbitrary operating-system commands as the backend process. This occurs because the application fails to properly sanitize domain and email values store...

PT-2026-98224

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0 Description When the LLM PARSING feature is enabled, an authenticated user with write permission to a trip instance can store an attacker-controlled llm base url via the settings API. This value is processed by the...

PT-2026-97786

Name of the Vulnerable Software and Affected Versions Custom Thank You Page for WooCommerce versions prior to 1.1.3 Description The plugin is subject to unauthorized access and data loss because the save option function lacks a capability check. This flaw allows unauthenticated attackers to expor...

CVE-2026-76086

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

GHSA-V3F3-CMJ4-CVJ9 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Impact The control panel action formie/integrations/form-settings IntegrationsController::actionFormSettings was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the formie/integrations/form-settings action in the control panel. An attacker can access and modify integration settings, potentially exfiltrating stored API keys or OAuth tokens by redirecting...

EUVD-2026-85545

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

GHSA-VMJQ-HVGQ-2WV4 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...