CVE-2026-93961

An improper authorization flaw exists in the usernameExist function of UserController.java in Dromara UJCMS up to version 12.3.1 . By manipulating the Username argument, a remote, unauthenticated attacker can obtain partial access to user information (CVSS 3.1 score: 5.3 MEDIUM , low confidential...

CVE-2026-86553

CVE-2026-86553 is a password reset vulnerability in the ZTE SmartLife mobile application. The root cause lies in how the app dynamically generates fresh authentication parameters within its runtime process. An attacker who acquires these parameters can directly call the backend endpoint /account/...

CVE-2026-86552

CVE-2026-86552 affects the ZTE SmartLife APP , where the app dynamically generates new authentication parameters at runtime. An attacker possessing valid SmartLife authentication credentials can complete account registration with any arbitrary email address via the backend endpoint /account/perso...

CVE-2026-93960

A vulnerability in Pixelfed (up to version 0.12.11 ) affects the OAuth Scope Handler component, specifically the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php. Manipulation of the ID argument leads to missing authentication , enabling a remote attacker with low privileges...

CVE-2026-93959

A SQL injection vulnerability exists in SourceCodester Online Reviewer Management System 1.0 , specifically in the file /reviewer_0/admins/assessments/course/btn_functions.php. The injection is triggered by manipulating the Course argument. The attack can be carried out remotely with no privilege...

CVE-2026-86551

The ZTE Z80Ultra (NX741J) smartphone is affected by an information disclosure vulnerability in the Settings.Secure database . Non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address , which is not properly restricted from unprivileged access....

CVE-2026-94084

Suricata versions before 8.0.7 contain a use-after-free vulnerability in the Http2ThreadMultiBuf component. The bug is triggered when an HTTP/2 transaction is inspected by Suricata rules that use http.response_header both with and without a transform, leading to a dangling pointer dereference. Th...

CVE-2026-94083

Suricata before 8.0.7 is affected by a DoH2 type confusion vulnerability. When a DoH2 request includes an HTTP/1 to HTTP/2 upgrade, the HTTP/2 state cleanup code is executed even though the actual connection state is HTTP/1, leading to an invalid free . The issue requires app-layer.protocols.doh2...

CVE-2026-93958

CVE-2026-93958 is an OS command injection vulnerability in the D-Link R95 router (firmware BE9500_1.00.16). The flaw resides in the DHMAPI component, specifically the system function within the file /bin/ssi. By manipulating the NTPServer argument, an attacker can inject arbitrary operating-syste...

CVE-2026-93957

CVE-2026-93957 affects olivier-ls PHP-FTS up to version 1.1.3. The vulnerability resides in the SearchEngine::matchesSingleFilter function within src/SearchEngine.php, part of the Filter Matching component. The root cause is an incorrect comparison (loose comparison leading to a filter bypass, CW...

CVE-2026-93956

CVE-2026-93956 is a cross-site scripting (XSS) vulnerability in the SearchEngine::buildHighlights function of src/SearchEngine.php in the PHP-FTS library (olivier-ls/php-fts) versions up to 1.1.2 . Manipulating the Query argument allows an attacker to inject malicious scripts, which execute in th...

CVE-2026-93993

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in its worktree creation process . The root cause is that git hooks are executed before trust validation , allowing an attacker to supply a repository with a crafted post-checkout hook that runs arbitrary shell commands wit...

CVE-2026-93992

Gopeed (a download manager) versions through 2.0.0-beta.3 contain a path traversal vulnerability in its archive extraction feature. Attackers can craft malicious archives whose entries include directory traversal sequences that bypass path validation. When a user downloads and extracts such an ar...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass in the ListArchivedWorkflows API. The root cause is a failure to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals (negated) operator . An attacker with namespace-scoped list...

CVE-2026-93990

Expat (libexpat) through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input. An attacker can craft UTF-16 encoded XML with lone high surrogates that consume subsequent code units, effectively hiding markup characters from the parser and enabling XML injection . The i...

CVE-2026-93989

The vLLM inference and serving engine (through version 0.29.0 ) is vulnerable to an Improper Validation of Array Index in the SamplingParams.update_from_tokenizer() function. A remote authenticated attacker can supply out-of-bounds bad_words token indices that fail to be validated against the mod...

CVE-2026-93988

QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...

CVE-2026-94057

Exim MTA versions before 4.100.1 are vulnerable to SMTP smuggling : the received message does not match any sent message and instead depends on crafted data sent after a rejection during DATA processing. The vulnerability is reachable over the network without authentication but requires high atta...

CVE-2026-94056

Exim before 4.100.1 is vulnerable to an information disclosure issue when Proxy-Protocol is used with an attacker-controlled proxy. The root cause is the reading of certain uninitialized data from stack memory , allowing a remote attacker to leak sensitive information. The CVSS 3.1 score is 7.5 (...

CVE-2026-94055

Exim versions prior to 4.100.1 are vulnerable to a use-after-free flaw when utilized with GnuTLS under specific non-default TLS settings. This vulnerability could allow a remote attacker to trigger a system crash, resulting in a denial of service (DoS) . To mitigate this risk, users should disabl...

CVE-2026-94054

Exim prior to 4.100.1 is vulnerable to an out-of-bounds write when Proxy-Protocol is used with an attacker-controlled proxy. The vulnerability is network-reachable with no required privileges but has high attack complexity , yielding a CVSS 3.1 base score of 7.0 (HIGH) with impacts of low confide...

CVE-2026-93955

grimmory-tools grimmory (up to 3.3.3/3.4.1) contains an authorization bypass in the Download Endpoint component. The vulnerable function streamFileToResponse in KoboController.java can be exploited by manipulating the bookId argument, allowing a remote, low-privilege attacker to access resources ...

CVE-2026-93954

grimmory-tools grimmory (up to 3.3.3/3.4.1) contains an incorrect authorization flaw in the Settings API Endpoint . The vulnerable function is AppSettingController.getAppSettings in backend/src/main/java/org/booklore/controller/AppSettingController.java. The issue arises because PR #2558 moved th...

CVE-2026-82672

CVE-2026-82672 is an HTTP Request/Response Smuggling vulnerability in the Elixir mint HTTP/1 client library (versions 0.1.0 through before 1.10.1). The root cause lies in Mint.HTTP1.Parse.chunk_size/1, which stops parsing a chunked response's chunk-size line at the first non-hexadecimal byte and ...

CVE-2026-82560

The Pod::Text component in Perl (versions before 6.1.1 ) is vulnerable to CPU and memory exhaustion when formatting a POD document. The root cause is that nested =over tags can drive the margin to equal the output width; at this point, the wrap() function's line-splitting substitution matches an ...

CVE-2026-94001

A flaw in the Admin REST API of Keycloak (an open-source identity and access management solution) allows a delegated administrator to bypass fine-grained reset-password permissions. The endpoint used for deleting user credentials fails to properly check these permissions, enabling an administrato...

CVE-2026-94000

A flaw in the Admin REST API of Keycloak (open-source identity and access management) exists in the group-membership endpoints . The system fails to check whether a group grants administrative privileges before allowing a user to be added to it. This allows a delegated administrator holding the m...

CVE-2026-93999

Keycloak's OIDC token refresh process contains a flaw where the server restores requested audiences from stored client IDs but fails to verify whether the target audience client is still enabled before issuing a new access token. This allows an application holding an existing refresh token to con...

CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. The newVolume() function in cmd/serve/docker/volume.go constructs a mountpoint via filepath.Join(drv.root, name) using the attacker-controlled name field from a Docker VolumeDriv...

CVE-2026-93986

rclone before 1.75.1 contains a path traversal vulnerability in how it handles names from server and third-party listing responses. The tool fails to confine object names to the listed directory, allowing attackers to craft names containing forward slashes and parent directory references (e.g., ....

CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd is affected by a sandbox escape in its JavaScript webhook template validator . The validator fails to block computed member access to constructor chains, allowing attackers with project write access to craft webhook templates using computed property no...

CVE-2026-93984

OpenPanel tracking API, through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 , fails to verify the client secret cryptographic hash before authorizing revenue events and bot filtering. An attacker possessing only a public client ID can supply arbitrary dummy secrets to inject forged revenue me...

CVE-2026-93983

OpenPanel (through commit bad75bdd ) contains a SQL injection vulnerability in its ClickHouse query layer. The root cause is a failure to escape property keys used in ClickHouse SQL queries, allowing an authenticated user to inject boolean SQL terms via crafted filter names. This enables attacker...

CVE-2026-93981

hono/jsx (a server-side rendering component of the hono web framework) before version 4.13.7 fails to HTML-escape plain strings in several rendering paths: child or fallback of Suspense , string child of ErrorBoundary alongside an async sibling, the single child of Context.Provider , and the root...

CVE-2026-93982

OpenPanel (through commit bad75bdd ) writes Model Context Protocol (MCP) authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP...

CVE-2026-78030

Perl DBI versions prior to 1.653 are vulnerable to arbitrary module loading due to unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM . The root cause is that DBD::DBM passes these attributes to require without verifying if they point to modules. Since require treats path-shaped strings as...

CVE-2026-93742

Totolink A3002MU routers running firmware Hh-B20211125.1046 are vulnerable to a command injection flaw in the formWsc function located in the file /boafrm/formWsc . The root cause is improper handling of the localPin argument, allowing a remote attacker to inject arbitrary commands. The vulnerabi...

CVE-2026-9858

Partial Shipment for Woocommerce (WordPress plugin, versions ≤ 3.4) is vulnerable to Missing Authorization via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. The root cause is that the AJAX handlers in woocommerce-partial-shipment.php (lines 228, 263, 291...

CVE-2026-9613

CVE-2026-9613 affects the Datalogics Ecommerce Delivery WordPress plugin in all versions up to and including 2.6.65 . The root cause is improper authorization verification in multiple AJAX actions (datalogics_create_shipping / datalogics_cancel_shipping), allowing authenticated users with subscri...

CVE-2026-1256

YS LeadGen – Popups, Opt-ins & Lead Capture for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.4 due to missing capability checks on popup management AJAX endpoints. Authenticated users with Subscriber-level or higher access can create arbitra...

CVE-2026-76579

LiteSpeed Cache for WordPress (all versions up to and including 7.9 ) contains a Reflected Cross-Site Scripting vulnerability in the ESI (esi) parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts by supplying a validly sign...

CVE-2026-9766

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.5.1 . The root cause is improper verification of user permissions in the empik_csv_process_emp_log_classes AJAX action, allowing any authenticated user with subscriber-level ...

CVE-2026-9289

WordLift – AI powered SEO – Schema plugin for WordPress (versions up to and including 3.54.10 ) is vulnerable to unauthenticated sensitive information exposure via its JSON-LD REST API endpoints (/wordlift/v1/jsonld/). The root cause is that these routes are registered with a permission_callback ...

CVE-2026-1255

CVE-2026-1255 affects the YS LeadGen WordPress plugin (Popups, Opt-ins & Lead Capture) in all versions up to and including 2.1.4 . The vulnerability is an unauthenticated information disclosure in the ysleadgen_get_captured_data AJAX action, which is accessible without authentication. This allows...

CVE-2026-8354

Gum Addon for Elementor (WordPress plugin) is vulnerable to Stored Cross-Site Scripting (XSS) via the pop_tag parameter in the popover_btn widget, affecting all versions up to and including 1.3.15 . The root cause is insufficient input sanitization and output escaping, allowing authenticated user...

CVE-2026-18346

The TikTok for Business WordPress plugin (all versions up to 1.4.1 ) is vulnerable to authorization bypass via the auth_code parameter. The plugin fails to verify that the requester is authorized before processing a token exchange, allowing an unauthenticated attacker to overwrite the merchant's ...

CVE-2026-5410

The Redux Framework WordPress plugin (versions ≤ 4.5.13) is vulnerable to Stored Cross-Site Scripting via the spinner field. The root cause is twofold: the user_meta_save() function only sanitizes array values, so scalar spinner values bypass sanitization entirely, and class-redux-spinner.php (li...

CVE-2026-15098

The Real3D Flipbook Lite WordPress plugin (up to 5.1.1 ) has a Stored Cross-Site Scripting flaw in the on_shortcode() and print_global_options() functions. Shortcode attribute values (e.g. lightboxtext) are copied into $this->flipbook_options and emitted via wp_json_encode() inside a sequence...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin (versions up to and including 4.14.0 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'data' Dynamic Content Tag , caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts i...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress contains a missing capability check on the iepa_use_gt_editor AJAX action , affecting all versions up to and including 0.4.7.7 . An authenticated attacker with Subscriber-level access or higher can update or delete arbitrary post meta ent...