CVE-2026-105126

LaraDashboard versions before 1.4.8 are susceptible to a privilege escalation vulnerability due to improper privilege management. Authenticated users with role.edit permissions can tamper with roles by renaming them to Superadmin or granting user.login_as permissions. This allows an attacker to t...

CVE-2026-105125

LaraDashboard versions prior to 1.4.8 are vulnerable to a path traversal vulnerability within the /api/translations/{lang} endpoint. This flaw allows unauthenticated attackers to read sensitive JSON files, such as composer.json, by manipulating the {lang} route segment. Specifically, on Windows h...

CVE-2026-105124

The W (vincent-peugnet/wcms) content management system, versions through 3.18.0 , is vulnerable to unauthenticated stored XSS . The root cause is the lack of input sanitization in the login user field and the visitor comment website field . Attackers can inject scripts via failed login attempts, ...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

CVE-2026-96451

The Ultimate Member WordPress plugin, versions through 2.13.1 , is vulnerable to a Privilege Escalation issue due to an Authorization Bypass Through User-Controlled Key (CWE-639). This vulnerability allows an attacker to escalate privileges within the system. While specific exploit code and a dir...

CVE-2026-103065

The Kirki WordPress plugin (versions

CVE-2026-103342

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 2.0.20 . While the specific ro...

CVE-2026-105052

The IBM Maximo Application Suite login service is vulnerable to a path traversal vulnerability (CWE-22) in versions 8.10, 8.11, 9.0, 9.1, and 9.2. A remote attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to traverse directories and view arbitrary files on...

CVE-2026-105122

OpenAM versions prior to 16.1.3 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The root cause is an unvalidated jwks_uri parameter during the registration or modification of OAuth 2.0 clients. An attacker can leverage this to force the server to fetch internal resources, po...

CVE-2026-105120

OpenAM before version 16.1.3 is affected by an authorization bypass vulnerability within the sessions REST endpoint query operation. This flaw allows users with delegated RealmAdmin privileges to bypass tenant boundaries by supplying a _queryFilter naming a different realm. Exploitation of this v...

CVE-2026-105121

Versions of OpenAM before 16.1.3 are affected by an improper authorization vulnerability. The root cause is that realm checks incorrectly use the requester's realm, allowing delegated administrators to bypass intended scoping. Authenticated accounts possessing the iplanet-am-session-destroy-sessi...

CVE-2026-105118

OpenAM versions prior to 16.1.3 are susceptible to an open redirect vulnerability. The root cause is the failure to verify the id_token_hint provided to the /oauth2/connect/endSession endpoint. Unauthenticated attackers can exploit this by supplying a forged hint to redirect victims to any regist...

CVE-2026-105119

OpenAM versions prior to 16.1.3 are vulnerable to a PKCE enforcement bypass via OAuth 2.0 hybrid flows . The root cause is that the software only applies Proof Key for Code Exchange (PKCE) enforcement to authorization requests where the response_type is exactly code. Consequently, codes issued th...

CVE-2026-105117

OpenAM versions prior to 16.1.3 are vulnerable to an email content injection vulnerability. This flaw allows unauthenticated attackers to manipulate notification email wording by interacting with the forgotPassword and register actions on the /json/{realm}/users endpoint. By supplying custom subj...

CVE-2026-105116

OpenAM versions prior to 16.1.3 are affected by a latent cross-site scripting (XSS) defect. The vulnerability occurs because the SAML message , relay state , and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. If the cookieHashRedirectEnabled setting is acti...

CVE-2026-105115

OpenAM versions prior to 16.1.3 are vulnerable to an unauthenticated arbitrary class instantiation vulnerability within the legacy JAX-RPC SOAP interface . Remote attackers can exploit this by sending SOAP requests to the */jaxrpc/ endpoint using an unverified session identifier and a specified c...

CVE-2026-105113

The Nezha Dashboard (versions 1.8.0 before 2.3.13) is vulnerable to an improper locking issue (CWE-667). The root cause is a non-deferred mutex unlock that leaks during a nil-map panic path . An authenticated non-admin member can trigger this by making four specific notification API calls, result...

CVE-2026-105114

OpenAM versions prior to 16.1.3 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the lack of encoding for crafted parameters rendered on the OAuth2 authorization error page . Unauthenticated attackers can leverage this by tricking victims into clicking a s...

CVE-2026-105112

The Nezha monitoring agent, versions 1.8.0 before 2.3.13 , is vulnerable to a lock-order inversion within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated non-admin users to trigger a deadlock in the alerting subsystem . By concurrently calling the notification-group and ...

CVE-2026-105105

The NASA-AMMOS AIT-Core (versions through 3.1.1 ) is vulnerable to CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server ). The underlying cause is that the ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by d...

CVE-2026-104983

A path traversal vulnerability exists in Linux Mint Xreader up to version 4.6.9 . The flaw resides in the PDF Attachment Saving Handler component, specifically within the g_file_get_child function of the shell/ev-window.c file. By manipulating the attachment argument, an attacker may perform a re...

CVE-2026-71890

Bouncy Castle for Java versions before 1.86 are vulnerable to an authorization flaw in the MLS (RFC 9420) protocol implementation. The org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals method fails to verify that a Remove proposal in an external commit belongs to the joiner. Thi...

CVE-2026-71891

In Bouncy Castle for Java before version 1.86 , the BLS12_381BasicScheme.keyValidate function (and associated components like BLSPublicKeyParameters) failed to properly validate public keys. It accepted keys built on a foreign ECCurve that shared the same field characteristic as BLS12-381 . The r...

CVE-2026-18040

Bouncy Castle for Java versions before 1.86 are vulnerable to the leakage of secret-derived data within the HQC implementation. The root cause involves two side channels: GF(2^8) arithmetic utilizing lookup tables indexed by field elements (making touched cache lines a function of the operand), a...

CVE-2026-71885

In Bouncy Castle for Java versions before 1.86 , the Messaging Layer Security (MLS, RFC 9420) implementation failed to bind an X.509 credential to a LeafNode's signature_key . Because the X.509 certificate chain was stored but never parsed or validated, the end-entity certificate's public key was...

CVE-2026-71886

In Bouncy Castle for Java before version 1.86 , the high-level OpenPGP certificate API contains a flaw where it accepts third-party certifications or trust delegations from any component key of an issuing certificate without verifying if that component had the authority to certify. Specifically, ...

CVE-2026-71887

The Bouncy Castle for Java high-level OpenPGP API (versions before 1.86 ) contains a vulnerability where it accepts data signatures from signing subkeys that lack a required embedded Primary Key Binding signature when the Key Flags subpacket is omitted. The flaw stems from inconsistent logic in O...

CVE-2026-71883

In Bouncy Castle for Java LTS before version 2.73.13 , one-shot native packet ciphers (AES-CBC, CCM, CFB, CTR, GCM, and GCM-SIV) suffer from a memory management flaw. The native code uses JNI's ReleaseByteArrayElements in mode 0, which commits native copies back into Java arrays. If an applicatio...

CVE-2026-71888

The Bouncy Castle for Java library (versions before 1.86 ) contains a vulnerability in the streaming CMS AuthenticatedData parser. The parser incorrectly handles messages where the digestAlgorithm and authAttrs fields disagree on the presence of authenticated attributes. Because the parser makes ...

CVE-2026-71889

Bouncy Castle for Java contains a vulnerability where the PKIXCertPathReviewer (both org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and the legacy org.bouncycastle.x509.PKIXCertPathReviewer) fails to apply X.509 name constraints to the end-entity certificate. The root cause is that checkNameCo...

CVE-2026-71892

Bouncy Castle for Java versions before 1.86 contain a flaw where opt-in key-size validation on CMS key-transport recipients fails for messages using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256 ). The root cause is an incorrect comparison between a byte array and an ASN1Obje...

CVE-2026-85515

Bouncy Castle for Java versions before 1.86 are vulnerable to a truncation error where truncated OpenPGP encrypted messages are accepted without reporting an error. On the SEIPD version 1 path, this leads to receiving CFB-decrypted plaintext without any integrity checks. On the AEAD path (SEIPD v...

CVE-2026-97873

The Bouncy Castle for Java library (before versions 1.86 and LTS 2.73.13 ) contains a vulnerability where the raw JCA provider's legacy PBES1 and PKCS#12 PBE families derive keys using an iteration count from untrusted input without bounding. An attacker could provide a small input to dictate an ...

CVE-2026-104982

A path traversal vulnerability exists in Linux Mint Xreader up to version 4.6.5 . The flaw resides in the EPUB File Handler component, specifically affecting the setup_document_content_list/g_strdup_printf functions within the backend/epub/epub-document.c file. This vulnerability can be exploited...

CVE-2026-92084

The Beaver Builder Page Builder plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 2.11.0.5 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. This vulnerability c...

CVE-2026-92767

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.0.5 . The root cause is insufficient input sanitization and output escaping within the 'offset' Shortcode Attribute . This allows authenticated attackers with ...

CVE-2026-100157

The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.4.3 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. Specifically, the xs_reviw_summery parameter is ...

CVE-2026-11601

The WPCafe WordPress plugin (versions up to and including 3.0.19 ) is vulnerable to an authorization bypass because it fails to verify user permissions for specific actions. Specifically, the Email_Automation_Service_Provider::is_enable() method unconditionally returns true, leaving endpoints act...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress (versions up to and including 8.97.0 ) is vulnerable to SQL Injection via the 'access_privileges' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient prepa...

CVE-2026-96267

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to a second-order SQL injection in all versions up to and including 8.7 . The root cause is insufficient escaping of the fullRef parameter and a lack of proper preparation on existing SQL queries. An unauthenticated ...

CVE-2026-104313

The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping specifically within the 'rule_data' parameter. This allows u...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.0 . The root cause is the plugin's failure to properly verify user permissions before performing actions. This allows authentica...

CVE-2026-103519

The WP Ultimate Review plugin for WordPress (all versions up to and including 2.4.3 ) is vulnerable to arbitrary shortcode execution . The root cause is a failure to properly validate input before passing it to the do_shortcode function. Authenticated attackers with subscriber-level access or hig...

CVE-2026-87115

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 1.2.21 . The root cause is insufficient file path validation within the extract function, specifically involving the old_vapcfN parameter...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.0.18 . The vulnerability exists within the (template scope) function , specifically related to the 'food_menu_style' Ele...

CVE-2026-93889

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.12 . The root cause is insufficient input sanitization and output escaping within the PHPMailer 'wp_mail_failed' error message. An unauthenticated att...

CVE-2026-93896

The WPFront Notification Bar plugin for WordPress (versions up to and including 3.5.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the write_debug_logs output path, which reflects the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly into a [removed] b...

CVE-2026-97660

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.5 . The root cause is insufficient input sanitization and output escaping. Unauthenticated attackers can exploit this via a guest checkout by emb...

CVE-2026-92974

The Photo Gallery by 10Web WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.8.46 . The root cause is insufficient input sanitization and output escaping of the thumb_url parameter. An unauthenticated attacker can inject arbitrary web scr...

CVE-2026-15795

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5.3 . The root cause is insufficient input sanitization and output escaping within Shortcode Attributes . This flaw allows authen...