CVE-2026-111610: Authorization Bypass Through User-Controlled Key

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

CVE-2026-111311: Unrestricted Upload of File with Dangerous Type

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

CVE-2026-111044: Incorrect Authorization

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

CVE-2026-86009: Improper Authorization

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails...

CVE-2026-111647: Authorization Bypass Through User-Controlled Key

PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET...

CVE-2026-107770: Missing Authorization

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-111387: Improper Removal of Sensitive Information Before Storage or Transfer

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read...

CVE-2026-104755: Improper Privilege Management

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

CVE-2026-89079: Improper Privilege Management

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

CVE-2026-17491: Improper Privilege Management

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive...

CVE-2026-19076: Incorrect Authorization

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed accoun...

CVE-2026-16754: Improper Certificate Validation

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...

CVE-2026-107648: Improper Neutralization of Input During Web Page Generation

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

CVE-2026-111389: Improper Neutralization of Special Elements used in an SQL Command

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-107758: Improper Neutralization of Input During Web Page Generation

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-110017: Improper Neutralization of Input During Web Page Generation

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-111676: Authorization Bypass Through User-Controlled Key

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-111619: Improper Neutralization of Special Elements used in an SQL Command

FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and...

CVE-2026-55836: Exposure of Sensitive Information to an Unauthorized Actor

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-111713: Improper Neutralization of Input During Web Page Generation

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-96768: Improper Neutralization of Input During Web Page Generation

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-93681: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-111383: Allocation of Resources Without Limits or Throttling

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111687: Improper Neutralization of Directives in Dynamically Evaluated Code

WeRSS we-mp-rss through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/feedid endpoint. Attackers can supply a non-built-in ext value and a =expression template whose object-subclass traversa...

CVE-2026-100106: Improper Neutralization of Input During Web Page Generation

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchasedplan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-92427: Exposure of Sensitive Information to an Unauthorized Actor

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

CVE-2026-107748: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping...

Red Hat: CVE-2026-111802: nautilus: nautilus: Arbitrary File Deletion via Trash Symlink

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage...

CVE-2026-111446: Incorrect Authorization

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

CVE-2026-77630: Uncontrolled Resource Consumption

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parsehostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parseuri is processing attacker-supplied hostnames from inbound HTTP request targets in...

CVE-2026-111652: Missing Authorization

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/ paths for .jpg, .png, .bmp, or .mp4 files, which are...

CVE-2026-107768: Improper Neutralization of Input During Web Page Generation

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for...

Red Hat: CVE-2026-85231: libtirpc: libtirpc: Denial of service via unbounded memory allocation during RPCSEC_GSS decoding

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

CVE-2026-68908: Free of Memory not on the Heap

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...

CVE-2026-18516: Improper Encoding or Escaping of Output

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-111400: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

CVE-2026-17073: Improper Access Control

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution...

CVE-2026-62439: Integer Overflow or Wraparound

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

CVE-2026-110805: Server-Side Request Forgery (SSRF)

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

CVE-2026-54657: Improper Authorization

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

CVE-2026-101335: Improper Control of Generation of Code

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminatorreplacequizformdata helper invoking doshortcode on the fully expanded notification bod...

CVE-2026-110901: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4...

Red Hat: CVE-2026-46471: gstreamer1-plugins-good: gstreamer1-plugins-good: information disclosure via out-of-bounds read during MP4 parsing

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

CVE-2026-96570: Improper Neutralization of Input During Web Page Generation

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-111607: Authorization Bypass Through User-Controlled Key

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the...

CVE-2026-111373: NULL Pointer Dereference

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

CVE-2026-18551: Incorrect Authorization

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API...

Red Hat: CVE-2026-111382: freerdp: freerdp: Arbitrary code execution via crafted display frames

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-92115: Improper Neutralization of Special Elements used in a Command

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the value parameter of the update-photo AJAX action. This is due to insufficient shell escaping within the wppaimagemagicka function, where the...

CVE-2026-92777: Use of Default Cryptographic Key

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code...