CVE-2026-58410

CVE-2026-58410 (ChurchCRM) — Prior to version 7.4.0, an improper object-level authorization flaw in family-scoped endpoints allowed authenticated, non-admin users with EditSelf access to read/modify records from other families by supplying a different familyId. The backend trusts attacker-control...

CVE-2026-15594

CVE-2026-15594 affects waooAI waoowaoo up to 0.4.1, specifically the function stablePublicIdFromStorageKey in the Media Handler’s src/lib/media/hash.ts. The vulnerability arises from manipulating the storageKey, resulting in improper authorization. Reportedly exploitable from remote and requires ...

CVE-2026-58409

ChurchCRM prior to 7.4.0 is vulnerable to authenticated RCE via uploading a malicious plugin ZIP containing a PHP webshell. The vulnerability stems from ALLOWED_EXTENSIONS including 'php' while DENIED_EXTENSIONS fails to block .php files, and extracted ZIP contents are placed under the web root, ...

CVE-2026-48363

CVE-2026-48363 affects ColdFusion versions 2025.9, 2023.20 and earlier. It is an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (the victim must open a malicious file). The issue...

CVE-2026-48364

CVE-2026-48364 affects ColdFusion versions 2025.9, 2023.20 and earlier. It is an Uncontrolled Search Path Element vulnerability that could enable arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim must open a malicious file); the impact is ...

CVE-2026-58408

ChurchCRM prior to version 7.4.0 exposes a CSV export endpoint that leaks full PII of every Person/Family. The POST /CSVCreateFile.php export is gated only by a coarse admin permission check and lacks a dedicated isAdmin/owner authorization, allowing any user with non-admin flags to trigger a bul...

CVE-2026-12385

CVE-2026-12385 affects the Smart Slider 3 WordPress plugin up to version 3.5.1.37. The issue is a Sensitive Information Exposure via the keyword parameter, enabling authenticated attackers with contributor-level access and above to extract titles and full content excerpts from private, draft, pen...

CVE-2026-12536

CVE-2026-12536 : A Stored Cross-Site Scripting flaw in the Avada (Fusion) Builder plugin for WordPress affects all versions up to 3.15.5. It arises from insufficient input sanitization and output escaping in the Module Title parameter. An authenticated attacker with Contributor-level access or hi...

CVE-2026-55771

CVE-2026-55771 affects CedarJava prior to 4.9.0, where EntityIdentifier.equals() has inverted null/self-reference checks, causing incorrect equality results in custom integrations. The bug does not alter Cedar’s authorization decisions (computed in Rust from JSON) but could affect external code p...

CVE-2026-55773

CVE-2026-55773 affects CedarJava (open‑source Cedar policy language for fine‑grained authorization). In versions < 2.3.6, < 3.4.1, and

CVE-2026-55772

CVE-2026-55772 affects CedarJava prior to versions 4.9 (and older 2.3.6, 3.4.1) where improper input handling can cause Record-to-Entity type confusion across the Java–Rust FFI boundary. CedarJava serializes authorization requests to the Rust cedar-policy evaluator as JSON, and the CedarMap miss-...

CVE-2026-61668

Technical details for CVE-2026-61668 are not publicly available in the provided documents. Monitor for updates and disclosure.

CVE-2026-61667

Technical details for CVE-2026-61667 are not publicly available in the provided documents. No affected products, root cause, or remediation are described. Monitor for updates as new information is published.

CVE-2026-14906

The vulnerability CVE-2026-14906 affects Firefox for iOS. Pages with malicious titles could cause saved webpages-as-PDF content to overwrite existing PDF files or bundled content within the Firefox for iOS app sandbox. Affected component is the PDF-saving process; root cause details are not expli...

CVE-2026-6875

CVE-2026-6875: A remote code execution vulnerability in the ServiceNow AI platform could allow an unauthenticated user to execute code within the platform in certain circumstances. The issue affects hosted and self-hosted ServiceNow deployments and is rated with a high impact (CVSS 4.0: Network a...

CVE-2026-49972

CVE-2026-49972 affects Laravel-Mediable prior to 7.0.0. A file upload vulnerability enables unauthenticated remote code execution via a double extension (e.g., shell.php.jpg). The attacker relies on PATHINFO_FILENAME preserving the inner .php extension in the base name, and on misconfigured serve...

CVE-2026-49971

Laravel-Mediable before 7.0.0 has a stored XSS in SVG file uploads. Both authenticated and anonymous users can upload unsanitized SVG files containing scripts (onload handlers, script tags, or foreignObject) which can store persistent XSS payloads. When victims view or preview the SVG, the payloa...

CVE-2026-49970

Vulnerability summary: Laravel-Mediable before 7.0.0 contains a path traversal flaw in File::sanitizePath() that lets attackers write uploaded files to arbitrary locations via MediaUploader::toDestination(), due to a permissive regex allowing dot/slash and a weak trailing trim. This can enable re...

CVE-2026-49969

Vulnerability overview: Laravel-Mediable

CVE-2026-58228

Summary: CVE-2026-58228 affects phoenix_live_view (Phoenix.LiveView.Utils) and enables XSS via due to scheme validation bypass. The root cause is the internal uri_scheme/1 helper in Phoenix.LiveView.Utils that only detects schemes when the first byte is an ASCII letter; inputs starting with ASCI...