Live Threat Intelligence Radar

CVE-2026-115803 is an authorization bypass vulnerability in Scada-LTS version 2.8.0. It affects the AmCharts Data API component, specifically the HttpServletRequest.getParameter function in the AmChartValuesAPI.java file. Manipulating the 'ids' argument can allow an attacker to bypass authorization controls remotely. The vendor is currently working on a new release with security enhancements to address this issue. No patch is available yet.

CVE-2026-115802 is a medium severity vulnerability in InternScience InternAgent version 1.5.0. It involves a weakness in the train function of the file tasks/AutoChem/code/experiment.py within the LoRA Loading component. The vulnerability allows inclusion of functionality from an untrusted control sphere due to manipulation of the argument base_model_name_or_path. The attack can be initiated remotely and exploit code is publicly available.

CVE-2026-108013 is a vulnerability in HCL Software BigFix Platform related to the use of an outdated Mozilla CA certificate bundle. Versions of the bundle dated before 2026/10/20 trust certificates whose private keys have been compromised, allowing an on-path attacker to impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by updating to the bundle version dated 2026/10/20 or later, available starting from BES Support v1520.

A stored Cross-Site Scripting (XSS) vulnerability exists in the WPVR WordPress plugin versions from 8.5.49 up to but not including 9.0.3. The plugin fails to properly sanitize and escape certain tour hotspot content before storing and displaying it on the front end. This flaw allows users with Contributor role or higher to inject malicious scripts that execute in the browsers of users viewing the affected tours.

GeoDirectory WordPress plugin versions before 2.8.194 have an improper access control vulnerability that allows unauthenticated attackers to modify guest-submitted listings when guest posting is enabled. Attackers can edit, unpublish, attach images to, or reassign any listing submitted by logged-out users without verifying ownership.

GeoDirectory WordPress plugin versions before 2.8.194 contain a code injection vulnerability due to improper escaping of administrator-defined text when generating PHP files. This flaw allows high privilege users, such as subsite administrators on multisite networks who normally cannot execute code, to achieve Remote Code Execution (RCE) that can be triggered by any unauthenticated visitor.

GeoDirectory WordPress plugin versions before 2.8.194 contain a stored Cross-Site Scripting (XSS) vulnerability. This occurs because some map shortcode attributes are not properly sanitized or escaped before being output within a style attribute. Users with Contributor role or higher can exploit this to inject malicious scripts that execute in the context of any user viewing the affected content.

GeoDirectory WordPress plugin versions before 2.8.194 contain an information exposure vulnerability. The plugin's unauthenticated AJAX handler does not verify status, ownership, or password when loading listings, allowing unauthenticated users to access non-public listings such as draft, pending, and private entries by specifying their IDs.

GeoDirectory WordPress plugin versions before 2.8.194 contain a path traversal vulnerability that allows users with Subscriber-level access or higher to read and delete files outside the web root. This occurs because the plugin does not properly validate user-supplied image URLs used as local file paths when saving front-end listings. The vulnerability is limited to files with allowed media extensions. Exploitation results in the disclosed file being publicly accessible and the original file being deleted.

GeoDirectory WordPress plugin versions before 2.8.194 have an information exposure vulnerability. The plugin does not verify status or ownership when rendering a listing's map-popup via certain REST routes. This allows unauthenticated users to access title, permalink, and card fields of non-public listings including draft, pending, private, and trashed entries.