Live threat intelligence radar

CVE-2026-125762 is a stored cross-site scripting (XSS) vulnerability in LeapWorx Premium Addons for Elementor affecting versions prior to 4.11.117. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in version 4.11.117.

CVE-2026-125450 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force's SureRank plugin affecting versions prior to 1.11.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. A fix is available in version 1.11.0.

CVE-2026-125431 is a missing authorization vulnerability in the Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized modifications. The issue affects versions prior to 6.0.8 and has been fixed in version 6.0.8. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-125045 is a stored cross-site scripting (XSS) vulnerability in John-Michael L'Allier's Create software. It affects versions from initial releases up to 3.1.1. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of other users. A fix is available in version 3.1.2.

CVE-2026-124496 is an authorization vulnerability in Apache Storm versions 3.0.0 up to but not including 3.2.0. The DRPC HTTP endpoint allows an authenticated user to impersonate another user without proper authorization checks, enabling execution of DRPC functions restricted to that other user. This issue is fixed in Apache Storm version 3.2.0.

CVE-2026-124495 is a vulnerability in Apache Storm versions 3.0.0 up to but not including 3.2.0. It involves the Logviewer serving files via symbolic links placed by workers running as the topology owner, allowing users who can submit topologies to read logs and other files accessible to the Logviewer process. The issue is fixed in version 3.2.0.

CVE-2026-124261 is a missing authorization vulnerability in Magepeople inc.'s Taxi Booking Manager for WooCommerce plugin. Versions from initial release up to 2.1.7 are affected. The flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized modifications. The issue is fixed in version 2.2.9.

Apache Roller versions 4.0 through 6.1.6 contain a vulnerability where any logged-in user can infer other users' email addresses by exploiting the user search functionality. The search matches input against email addresses as well as user names, allowing incremental confirmation of email addresses one character at a time. This issue is fixed in Apache Roller 6.1.7 and later, where the search for non-administrators only matches user names.

CVE-2026-105154 is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Roller versions 4.0 through 6.1.6 affecting the Planet feed aggregator administration. An unauthenticated attacker can induce a logged-in global administrator to trigger the addition of a Planet subscription by visiting a crafted web page. This allows the attacker to make the server fetch arbitrary URLs, including internal addresses, and publish fetched feed content without authentication. The vulnerability arises because recent versions accept GET requests for this action, which are not protected by CSRF tokens. Apache Roller 6.1.7 and later address this issue by requiring POST requests with valid CSRF tokens and disabling the Planet aggregator by default.

CVE-2026-105153 is an XML External Entity (XXE) vulnerability in Apache Roller versions 4.0 through 6.1.6. It allows any authenticated user, even without weblog permissions, to read files accessible by the Roller process and to cause the server to make outbound HTTP requests to attacker-controlled destinations. This occurs because the AtomPub endpoint parses Atom entries with an XML parser configuration that permits external entities and DTD subsets before authorization checks or feature enablement checks. The vulnerability is fixed in Apache Roller 6.1.7 and later, which use a hardened XML parser configuration and reject AtomPub requests when the feature is disabled.