CVE-2026-96119
(9.9 CRITICAL)

EPSS: 0.51%

updated 2026-10-13T15:17:52.047000

1 posts

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

CVE-2026-93907
(8.1 HIGH)

EPSS: 0.00%

updated 2026-10-13T15:17:51.033000

2 posts

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

CVE-2026-90911
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-13T15:17:50.500000

1 posts

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVE-2026-65198
(8.6 HIGH)

EPSS: 0.00%

updated 2026-10-13T15:17:46.823000

2 posts

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey

CVE-2026-65173
(9.1 CRITICAL)

EPSS: 0.00%

updated 2026-10-13T15:17:46.473000

2 posts

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.

CVE-2026-101020
(7.8 HIGH)

EPSS: 0.10%

updated 2026-10-13T14:31:20.750000

2 posts

An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.

CVE-2026-95680
(8.0 HIGH)

EPSS: 0.00%

updated 2026-10-13T14:17:45.437000

2 posts

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

CVE-2026-93892
(8.1 HIGH)

EPSS: 0.28%

updated 2026-10-13T14:17:45.163000

1 posts

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

CVE-2026-90912
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-13T14:17:44.610000

1 posts

IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

CVE-2026-89110
(9.9 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T14:17:43.367000

1 posts

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

CVE-2026-89107
(9.9 CRITICAL)

EPSS: 0.37%

updated 2026-10-13T14:17:43.093000

1 posts

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the atta

CVE-2026-74043
(9.0 CRITICAL)

EPSS: 0.00%

updated 2026-10-13T14:17:41.003000

2 posts

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.

CVE-2026-74041
(9.1 CRITICAL)

EPSS: 0.00%

updated 2026-10-13T14:17:40.860000

2 posts

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

CVE-2026-74040
(9.1 CRITICAL)

EPSS: 0.00%

updated 2026-10-13T14:17:40.720000

2 posts

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager

CVE-2026-74034
(7.5 HIGH)

EPSS: 0.00%

updated 2026-10-13T14:17:40.087000

2 posts

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.

CVE-2026-108746
(8.8 HIGH)

EPSS: 0.28%

updated 2026-10-13T14:17:20.710000

1 posts

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.

CVE-2026-104803
(9.8 CRITICAL)

EPSS: 0.45%

updated 2026-10-13T13:30:21.620000

1 posts

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation i

CVE-2026-104759
(8.1 HIGH)

EPSS: 0.52%

updated 2026-10-13T13:30:21.620000

1 posts

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonc

CVE-2026-108971
(9.6 CRITICAL)

EPSS: 0.22%

updated 2026-10-13T13:29:12.567000

2 posts

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.

CVE-2026-108804
(10.0 CRITICAL)

EPSS: 2.39%

updated 2026-10-13T13:29:12.567000

1 posts

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL

CVE-2026-108576
(10.0 CRITICAL)

EPSS: 2.45%

updated 2026-10-13T13:29:12.567000

1 posts

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-78529
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:29:12.567000

1 posts

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

CVE-2026-66569
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:29:12.567000

1 posts

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVE-2026-81797
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-13T13:29:12.567000

1 posts

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

CVE-2026-78535
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-13T13:29:12.567000

1 posts

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

CVE-2026-78533
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-13T13:29:12.567000

1 posts

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

CVE-2026-94538
(8.1 HIGH)

EPSS: 0.25%

updated 2026-10-13T13:29:12.567000

1 posts

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, mo

CVE-2026-93746
(7.5 HIGH)

EPSS: 0.53%

updated 2026-10-13T13:29:12.567000

1 posts

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents

CVE-2026-91136
(7.5 HIGH)

EPSS: 1.78%

updated 2026-10-13T13:29:12.567000

1 posts

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — san

1 repos

https://github.com/fl0ydsec/CVE-2026-91136

CVE-2026-109687
(7.6 HIGH)

EPSS: 0.23%

updated 2026-10-13T13:28:15.717000

2 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

CVE-2026-93936
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-13T13:28:15.717000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVE-2026-93945
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-13T13:28:15.717000

2 posts

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVE-2026-93935
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVE-2026-104398
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-13T13:28:15.717000

2 posts

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

CVE-2026-78530
(7.7 HIGH)

EPSS: 0.40%

updated 2026-10-13T13:28:15.717000

1 posts

Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

CVE-2026-66568
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

CVE-2026-66567
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-13T13:28:15.717000

1 posts

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

CVE-2026-66566
(8.1 HIGH)

EPSS: 0.28%

updated 2026-10-13T13:28:15.717000

1 posts

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

CVE-2026-62046
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVE-2026-62045
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVE-2026-93934
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

CVE-2026-93933
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

CVE-2026-93932
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

CVE-2026-93931
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

CVE-2026-105892
(9.8 CRITICAL)

EPSS: 0.42%

updated 2026-10-13T13:28:15.717000

1 posts

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

CVE-2026-106610
(9.8 CRITICAL)

EPSS: 0.48%

updated 2026-10-13T13:28:15.717000

1 posts

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

1 repos

https://github.com/KevineCharles/CVE-2026-106610-miniorange-otp-ato

CVE-2026-96341
(8.2 HIGH)

EPSS: 0.28%

updated 2026-10-13T13:28:15.717000

1 posts

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

CVE-2026-93930
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVE-2026-93929
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

CVE-2026-93927
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.

CVE-2026-93944
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVE-2026-93943
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

CVE-2026-93942
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVE-2026-93941
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVE-2026-93940
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVE-2026-93937
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-13T13:28:15.717000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVE-2026-105889
(9.3 CRITICAL)

EPSS: 0.26%

updated 2026-10-13T13:28:15.717000

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVE-2026-109157
(9.9 CRITICAL)

EPSS: 0.00%

updated 2026-10-13T12:33:06

2 posts

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, w

CVE-2026-94410
(4.3 MEDIUM)

EPSS: 0.00%

updated 2026-10-13T12:33:06

2 posts

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

CVE-2026-96266
(8.2 HIGH)

EPSS: 0.17%

updated 2026-10-13T12:17:16.087000

1 posts

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it

CVE-2026-96262
(8.2 HIGH)

EPSS: 0.17%

updated 2026-10-13T12:17:15.420000

1 posts

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to t

CVE-2026-108598
(9.8 CRITICAL)

EPSS: 0.73%

updated 2026-10-13T12:17:13.100000

1 posts

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

CVE-2026-108549
(8.1 HIGH)

EPSS: 0.45%

updated 2026-10-13T12:17:12.747000

1 posts

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

CVE-2026-63354
(9.6 CRITICAL)

EPSS: 0.00%

updated 2026-10-13T10:17:18.450000

2 posts

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the

CVE-2026-13138
(8.6 HIGH)

EPSS: 0.24%

updated 2026-10-13T09:30:55

2 posts

Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.

CVE-2026-108179
(7.6 HIGH)

EPSS: 0.24%

updated 2026-10-13T09:30:54

2 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.

CVE-2026-109110
(10.0 CRITICAL)

EPSS: 2.03%

updated 2026-10-13T09:30:54

3 posts

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

CVE-2026-109109
(10.0 CRITICAL)

EPSS: 0.58%

updated 2026-10-13T09:30:49

2 posts

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was cont

CVE-2026-109758(CVSS UNKNOWN)

EPSS: 0.53%

updated 2026-10-13T06:30:33

1 posts

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that

CVE-2026-35001
(7.8 HIGH)

EPSS: 0.20%

updated 2026-10-13T03:30:43

1 posts

OpenS100 through commit daa35b contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser that allows remote attackers to cause a heap-based buffer overflow by opening a crafted S-102 HDF5 file with malicious grid dimension metadata. Attackers can exploit the unvalidated multiplication of numPointsLatitudinal and numPointsLongitudinal values in the S102_VG_BathymetryCoverag

CVE-2026-92883
(8.7 HIGH)

EPSS: 0.27%

updated 2026-10-13T03:30:43

1 posts

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted ou

CVE-2026-97229
(10.0 CRITICAL)

EPSS: 0.56%

updated 2026-10-13T03:30:37

16 posts

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

1 repos

https://github.com/AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE

CVE-2026-89113
(8.8 HIGH)

EPSS: 0.35%

updated 2026-10-13T03:30:31

1 posts

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on conf

CVE-2026-89111
(10.0 CRITICAL)

EPSS: 0.27%

updated 2026-10-13T03:16:41.133000

2 posts

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

CVE-2026-87689
(9.8 CRITICAL)

EPSS: 0.37%

updated 2026-10-13T01:16:47.110000

4 posts

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers

CVE-2026-93891
(7.6 HIGH)

EPSS: 0.33%

updated 2026-10-13T00:31:47

1 posts

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

CVE-2026-85457
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-13T00:31:47

1 posts

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

CVE-2026-90921
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-13T00:31:19

1 posts

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.

CVE-2026-90920
(9.8 CRITICAL)

EPSS: 0.54%

updated 2026-10-13T00:31:18

1 posts

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

CVE-2026-18166
(7.7 HIGH)

EPSS: 0.42%

updated 2026-10-12T23:17:36.577000

1 posts

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

CVE-2025-26240
(8.4 HIGH)

EPSS: 0.39%

updated 2026-10-12T22:10:00.247000

1 posts

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

1 repos

https://github.com/Habuon/CVE-2025-26240

CVE-2026-96263
(8.2 HIGH)

EPSS: 0.17%

updated 2026-10-12T21:32:12

1 posts

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation cou

CVE-2026-96265
(8.2 HIGH)

EPSS: 0.17%

updated 2026-10-12T21:32:12

1 posts

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploit

CVE-2026-96264
(8.2 HIGH)

EPSS: 0.17%

updated 2026-10-12T21:32:12

1 posts

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to

CVE-2026-87744
(9.1 CRITICAL)

EPSS: 0.29%

updated 2026-10-12T21:31:59

1 posts

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permiss

CVE-2026-65954
(8.6 HIGH)

EPSS: 0.21%

updated 2026-10-12T19:16:39.567000

1 posts

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths

CVE-2026-57143
(8.8 HIGH)

EPSS: 0.22%

updated 2026-10-12T19:16:39.110000

1 posts

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attemp

CVE-2026-85966
(7.7 HIGH)

EPSS: 0.30%

updated 2026-10-12T18:32:02

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.

CVE-2026-85965
(8.0 HIGH)

EPSS: 0.24%

updated 2026-10-12T18:32:02

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.

CVE-2026-9191
(9.6 CRITICAL)

EPSS: 0.21%

updated 2026-10-12T18:31:42

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

CVE-2026-85947
(9.9 CRITICAL)

EPSS: 0.35%

updated 2026-10-12T18:31:35

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

CVE-2026-85975
(7.5 HIGH)

EPSS: 0.18%

updated 2026-10-12T17:17:38.250000

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.

CVE-2026-85956
(9.6 CRITICAL)

EPSS: 0.31%

updated 2026-10-12T16:17:07.193000

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

CVE-2026-85955
(9.9 CRITICAL)

EPSS: 0.45%

updated 2026-10-12T16:17:07.070000

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

CVE-2026-85948
(9.9 CRITICAL)

EPSS: 0.35%

updated 2026-10-12T16:17:06.173000

1 posts

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

CVE-2026-92877
(0 None)

EPSS: 0.27%

updated 2026-10-12T15:17:09.890000

2 posts

The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.

CVE-2026-79992
(7.8 HIGH)

EPSS: 0.14%

updated 2026-10-12T09:33:51

1 posts

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

CVE-2026-78355
(8.7 HIGH)

EPSS: 0.72%

updated 2026-10-12T09:31:29

1 posts

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server proc

CVE-2026-93582
(9.4 CRITICAL)

EPSS: 0.39%

updated 2026-10-12T09:31:29

2 posts

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables. As a result, an unauthenticated remote attacker can supply a crafted Remote-User request header

CVE-2026-1907
(0 None)

EPSS: 0.13%

updated 2026-10-12T09:16:43.683000

1 posts

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate

CVE-2026-78357
(9.1 CRITICAL)

EPSS: 0.30%

updated 2026-10-12T07:16:37.073000

2 posts

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privil

CVE-2026-87690
(8.8 HIGH)

EPSS: 0.41%

updated 2026-10-12T06:31:24

1 posts

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying

CVE-2026-66086
(9.8 CRITICAL)

EPSS: 0.46%

updated 2026-10-12T03:33:04

1 posts

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

CVE-2026-108980
(8.8 HIGH)

EPSS: 1.06%

updated 2026-10-12T03:33:04

1 posts

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Do

CVE-2026-108781
(6.3 MEDIUM)

EPSS: 0.20%

updated 2026-10-12T03:33:04

1 posts

A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The expl

CVE-2026-108985
(7.1 HIGH)

EPSS: 0.18%

updated 2026-10-12T03:32:57

1 posts

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

CVE-2026-108982
(0 None)

EPSS: 0.11%

updated 2026-10-12T03:17:18.667000

1 posts

VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB sessi

CVE-2026-108963
(8.8 HIGH)

EPSS: 1.69%

updated 2026-10-11T21:30:58

1 posts

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly.

CVE-2026-108976
(7.8 HIGH)

EPSS: 0.51%

updated 2026-10-11T21:16:43.580000

1 posts

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

CVE-2026-19935
(7.5 HIGH)

EPSS: 0.18%

updated 2026-10-11T18:16:59.410000

1 posts

The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (0x0080-0x00FF). Channel teardown in l2cap_chan_destroy() in subsys/bluetooth/host/l2cap.c cancels the retransmission-timeout work and drains the RX FI

CVE-2026-19736
(7.8 HIGH)

EPSS: 0.11%

updated 2026-10-11T18:16:58.810000

1 posts

The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_HEALTH_TESTS variant, which always copies whole 32-bit words and draws entropy rounded up to a multiple of 128 bytes. Its "caller buffer is full" guard tests dataSize == 0, so a req

CVE-2026-19669
(7.8 HIGH)

EPSS: 0.12%

updated 2026-10-11T18:16:58.563000

1 posts

The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len], sized directly by the caller-supplied len argument. len is an unvalidated size_t taken straight from the syscall ABI, and the VLAs were alloc

CVE-2026-108859
(7.5 HIGH)

EPSS: 0.55%

updated 2026-10-11T15:31:14

1 posts

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

CVE-2026-108753
(9.4 CRITICAL)

EPSS: 0.34%

updated 2026-10-11T15:31:13

2 posts

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

CVE-2026-108758
(8.2 HIGH)

EPSS: 0.26%

updated 2026-10-11T15:31:13

1 posts

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain managem

CVE-2026-108853
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-11T15:31:12

1 posts

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assistant IDs to permanently delete victims' applications, workflows, conversations, and associated data.

CVE-2026-108718
(8.1 HIGH)

EPSS: 0.27%

updated 2026-10-11T15:31:11

1 posts

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.

CVE-2026-108740
(8.3 HIGH)

EPSS: 0.33%

updated 2026-10-11T15:31:11

1 posts

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.

CVE-2026-108905
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-11T15:16:56.913000

1 posts

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.

CVE-2026-108902
(8.1 HIGH)

EPSS: 0.38%

updated 2026-10-11T15:16:56.447000

1 posts

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.

CVE-2026-108865
(8.2 HIGH)

EPSS: 0.32%

updated 2026-10-11T14:17:06.640000

1 posts

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.

CVE-2026-108863
(7.5 HIGH)

EPSS: 0.42%

updated 2026-10-11T14:17:06.360000

1 posts

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration.

CVE-2026-108860
(9.1 CRITICAL)

EPSS: 0.48%

updated 2026-10-11T14:17:05.933000

1 posts

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.

CVE-2026-108760
(7.6 HIGH)

EPSS: 0.24%

updated 2026-10-11T13:17:21.310000

1 posts

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.

CVE-2026-108739
(7.5 HIGH)

EPSS: 0.32%

updated 2026-10-11T13:17:18.383000

1 posts

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.

CVE-2026-108714
(7.5 HIGH)

EPSS: 0.36%

updated 2026-10-11T13:17:14.430000

1 posts

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.

CVE-2026-96227
(8.8 HIGH)

EPSS: 0.28%

updated 2026-10-11T12:32:13

2 posts

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

CVE-2026-93550
(4.3 MEDIUM)

EPSS: 0.18%

updated 2026-10-11T12:17:28.543000

1 posts

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP file

CVE-2026-89234
(8.6 HIGH)

EPSS: 0.27%

updated 2026-10-11T12:17:27.033000

1 posts

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

CVE-2026-89232
(8.6 HIGH)

EPSS: 0.27%

updated 2026-10-11T12:17:26.880000

1 posts

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

CVE-2026-86717
(9.1 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T12:17:24.653000

1 posts

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

CVE-2026-108540
(9.9 CRITICAL)

EPSS: 1.70%

updated 2026-10-11T07:17:23.643000

1 posts

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108707
(9.8 CRITICAL)

EPSS: 0.55%

updated 2026-10-11T02:16:39.477000

1 posts

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

CVE-2026-108677
(6.5 MEDIUM)

EPSS: 0.23%

updated 2026-10-10T22:16:44.800000

1 posts

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.

CVE-2026-106609
(7.5 HIGH)

EPSS: 0.22%

updated 2026-10-10T18:31:27

1 posts

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

CVE-2026-106608
(7.2 HIGH)

EPSS: 0.26%

updated 2026-10-10T18:31:26

1 posts

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

CVE-2026-103071
(7.5 HIGH)

EPSS: 0.25%

updated 2026-10-10T18:31:26

1 posts

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

CVE-2026-108546
(7.5 HIGH)

EPSS: 0.80%

updated 2026-10-10T15:30:30

1 posts

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as

CVE-2026-105885
(8.8 HIGH)

EPSS: 0.29%

updated 2026-10-10T15:30:29

1 posts

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVE-2026-108161
(7.5 HIGH)

EPSS: 1.10%

updated 2026-10-10T15:30:22

1 posts

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a priv

CVE-2026-108553
(7.5 HIGH)

EPSS: 0.18%

updated 2026-10-10T15:16:58.410000

1 posts

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

CVE-2026-108551
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-10-10T15:16:58.273000