CVE-2026-104022 Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the addchild function calling addrole'academystudent' on any existing account resolved from the...

CVE-2026-93883 Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter

The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104915 Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...

CVE-2026-108474

JetBrains Exposed versions prior to 1.5.1 are vulnerable to an SQL injection flaw. The vulnerability stems from unescaped string arguments passed to several SQL functions. This flaw allows an attacker to potentially compromise the integrity, confidentiality, and availability of the database. Reme...

CVE-2026-22061

Trident versions v25.02.1 through v26.06.1 are vulnerable to a Debug Log Information Disclosure vulnerability (CWE-215 ). An authenticated attacker who gains access to the system's debug logs could potentially view highly sensitive information, specifically LUKS passphrases or SMB Active Director...

CVE-2026-108269

Prior to version 0.5.0 , the Rust and Go challenge verifiers in Remote Attestation TLS Clients are vulnerable to an Origin Validation Error (CWE-346). The flaw exists because the verifiers accepted quote ReportData bound only to the certificate public key and client nonce, rather than the active ...

CVE-2026-108268

Enclave OS Virtual contains a vulnerability where the TDX/GPU RA-TLS certificate issuer fails to include a value bound to the active TLS session within the quote ReportData . This omission allows an attacker who possesses an enclave TLS private key to relay a genuine quote to a different connecti...

CVE-2026-108267

The Privasys Go programming language fork, which provides RA-TLS support for crypto/tls , is vulnerable in versions prior to privasys-v0.5.1-go1.26.5 . In challenge-mode RA-TLS, certificates failed to bind quote ReportData to the active TLS session, binding it only to the certificate public key a...

CVE-2026-108266

The Privasys rustls library, a fork of rustls providing RA-TLS challenge and channel-binding support, is vulnerable in versions prior to privasys-v0.8.1 . The root cause is that RA-TLS challenge certificates emitted by the library bound quote ReportData to the certificate public key and client no...

CVE-2026-108265

The Enclave OS Mini Rust-based runtime for Intel SGX enclaves contains a vulnerability in the RA-TLS challenge certificate path (prior to wasm-v0.40.0 ). The issue stems from the runtime placing the certificate public-key hash and client nonce in the quote ReportData while failing to include a va...

CVE-2026-108264

Wizarr, a management system for media servers like Jellyfin and Plex, is vulnerable to Server-Side Template Injection (SSTI) prior to version 2026.9.1 . The issue exists because wizard step Markdown—provided via the editor or imported bundles—is evaluated in a non-sandboxed Jinja2 environment wit...

CVE-2026-62376

The open-source task management platform Vikunja (versions prior to 2.4.0 ) is vulnerable to account takeover due to the plaintext storage of sensitive tokens in the user_tokens table. Specifically, password-reset , email-confirmation , and account-deletion tokens are stored as raw random strings...

CVE-2026-62367

In Vikunja versions 1.0.0 through 2.3.0 , a vulnerability exists where an administrator enabling the emailfallback option on an OpenID Connect (OIDC) provider allows for local account takeover. The system incorrectly links an SSO login to a pre-existing local (username+password) account using onl...

CVE-2026-108263

Astron Agent , an agentic workflow platform, is vulnerable to cross-tenant Remote Code Execution (RCE) in versions prior to 1.1.2 . The root cause lies in the LocalExecutor within core/workflow/engine/nodes/code/code_node.py, which is selected by default via the /console-api/workflow/code/run and...

CVE-2026-57458

The Vikunja task management platform (version 2.3.0 ) contains a vulnerability where a scoped API token restricted to the oauth.authorize permission can be used to mint unrestricted OAuth session credentials. Specifically, an attacker can call POST /api/v1/oauth/authorize to obtain an authorizati...

CVE-2026-108261

Tina, a headless content management system, is vulnerable to an origin validation error in versions prior to tinacms 3.14.0 and @tinacms/app 2.5.14 . The vulnerability exists because the /~/* admin preview route can convert an attacker-controlled hash-router splat into an off-origin iframe URL vi...

CVE-2026-108260

The @tinacms/web-components package in the TinaCMS headless content management system is vulnerable to stored XSS in versions prior to 0.2.1 . The root cause is located in packages/@tinacms/web-components/src/tina-markdown.js, where the tina-markdown element assigns a node.url value directly to a...

CVE-2026-92705

The cross-platform subtitle editor Aegisub (versions 3.2.0 to 3.4.2) is vulnerable to arbitrary code execution because it automatically loads Automation scripts referenced in ASS project metadata without verifying user trust. An attacker can distribute a crafted ASS file and a malicious script to...

CVE-2026-108259

The headless content management system Tina contains a code injection vulnerability in versions prior to 3.0.0 . The @tinacms/cli component fails to sanitize Git branch names retrieved from environment variables like VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD. These raw values are interpolated...

CVE-2026-108258

Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...

CVE-2026-107857

The Mindwtr mobile application (versions prior to 1.1.5 ) suffers from a vulnerability where the Cloud sync bearer token and WebDAV password are stored in plaintext within unencrypted AsyncStorage . Specifically, these credentials are stored under the keys @mindwtr_cloud_token and @mindwtr_webdav...

CVE-2026-107856

CiviForm versions prior to 3.33.0 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to properly validate ownership when processing requests to GET /admin/tiDash/editClientForm/:accountId. While the system confirms the requester is a Trusted Intermediary , th...

CVE-2026-107854

The Jexactyl game management and billing system (versions 4.0.0 to 4.0.5 ) contains an authorization bypass vulnerability in the POST /api/client/billing/free/process endpoint. The application fails to verify ownership when processing a client-controlled server_id , allowing an authenticated user...

CVE-2026-107852

In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...

CVE-2026-107851

The Contao Open Source CMS (versions 5.7.0 through 5.7.12) contains an improper access control vulnerability in the TableAccessVoter::hasAccessToModule() function located in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php. The root cause is that the voter caches authorization de...

CVE-2026-107850

The Contao Open Source CMS is vulnerable to improper access control in the preview links module from versions 5.7.1 until 5.7.12 . The root cause is a configuration error in core-bundle/config/services.yaml, where the preview access voter is registered under an incorrect class name. This causes S...

CVE-2026-107848

The Contao Open Source CMS (versions 4.0.0 until 5.3.50 and 5.7.12) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is that RequestTokenListener only validates the REQUEST_TOKEN for POST requests, while the declarative GET guard only activates when an act parameter is pr...

CVE-2026-91136

The WordPress Divi Plus plugin (versions

CVE-2026-97340

The Avada WordPress theme and WooCommerce theme (versions

CVE-2026-107657

The WordPress HivePress (Business Directory, Listings & Classified Ads) plugin, version

CVE-2026-102774

The SureDash (Community, Courses & Member Dashboard) WordPress plugin versions

CVE-2026-96765

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress (versions

CVE-2026-97396

The Retainful plugin (Email Marketing for WordPress and WooCommerce) for WordPress is affected by an authenticated (Subscriber+) stored cross-site scripting (XSS) vulnerability in versions

CVE-2026-96662

The LatePoint (Calendar & Scheduling for WordPress) plugin for WordPress is vulnerable to an unauthenticated SQL injection in versions

CVE-2026-100147

The WordPress Plugin Funnel Builder by FunnelKit (versions

CVE-2026-101920

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors WordPress plugin (versions

CVE-2026-96563

The WordPress Motors – Car Dealership & Classified Listings plugin, in versions

CVE-2026-102291

The Kirki WordPress plugin (versions

CVE-2026-96572

The WP Meteor Page Speed Optimization Topping WordPress plugin (versions

CVE-2026-104759

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) WordPress plugin is vulnerable in versions

CVE-2026-96653

The WordPress WP Directory Kit plugin in versions

CVE-2026-93746

The WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin (versions

CVE-2026-103478

The WordPress Premium Packages (WPDM) plugin, specifically versions

CVE-2026-104803

The WPCOM Member WordPress plugin, versions

CVE-2026-101921

The WPForms – AI Form Builder for WordPress plugin (versions

CVE-2026-96574

The WP User Frontend plugin for WordPress (versions

CVE-2026-96278

The WP Photo Album Plus plugin for WordPress (versions

CVE-2026-104722

The Listdom WordPress plugin (versions

CVE-2026-104728

The AutomatorWP WordPress plugin (versions

CVE-2026-107845

The Contao Open Source CMS is vulnerable to Cross-site scripting (XSS) in the comments bundle (versions 4.0.0 through 5.3.50 and 5.7.12). The root cause is insufficient attribute and URL encoding of email or website metadata within the listComments() function in comments-bundle/contao/dca/tl_comm...