The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.
Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5. [...]
Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after users report that it deactivated, or in some cases completely removed, perpetual Office 2016 and Office 2019 installations. [...]
CVE-2026-94132 is a critical remote code execution vulnerability in the AcyMailing Enterprise extension for Joomla versions 6.0.0 through 11.0.5. The vulnerability arises because the mailbox action feature saves MIME parts of incoming emails without validating file extensions, allowing attackers to upload dangerous file types such as PHP scripts to a web-accessible directory. This flaw enables an attacker who can send emails to the monitored mailbox to write malicious PHP files into the web root, potentially leading to full system compromise.
CVE-2026-97163 is a critical vulnerability in the lomart.fr UP plugin for Joomla affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated remote code installation. The vulnerability has a CVSS 4.0 base score of 10.0, indicating it is exploitable over the network without authentication and can lead to severe impact. No patch or remediation information is currently available from the vendor.
The UP plugin for Joomla by lomart.fr contains multiple SQL injection vulnerabilities in versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. These vulnerabilities allow attackers to improperly neutralize special elements in SQL commands, potentially enabling manipulation of database queries. The issue is classified under CWE-89 and has a high severity rating with a CVSS score of 8.3.
A critical path traversal vulnerability (CWE-22) exists in the lomart.fr UP plugin for Joomla, affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. This vulnerability allows unauthorized access to restricted directories and files by improperly limiting pathname inputs. It has a high CVSS 4.0 score of 9.2, indicating it is network exploitable without requiring privileges or user interaction, with a high impact on confidentiality and security controls. No official patch or remediation guidance is currently available.
CVE-2026-97160 is a critical code injection vulnerability in the lomart.fr UP plugin for Joomla. It allows authenticated users with high privileges to inject and execute arbitrary PHP code. The flaw affects versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29 of the plugin. The vulnerability is classified as CWE-94 and has a CVSS 4.0 score of 9.4, indicating a severe security risk.
A vulnerability in the AcyMailing extension for Joomla versions 6.0.0 through 11.0.5 allows an unauthenticated subscriber to delete arbitrary files on the server. This occurs because a subscriber can store a path in a file-type custom field, which the extension deletes when the field is cleared, including files outside the intended upload folder such as configuration.php. The vulnerability is classified as CWE-89 (SQL Injection) and has a high severity with a CVSS score of 8.3.
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]
Adminer versions from 5.5.1 through 6.0.1 contain a server-side request forgery (SSRF) vulnerability due to improper parsing of the login 'server' string. This allows a remote unauthenticated attacker to craft a server value that bypasses privileged-port restrictions and causes the server to initiate TCP connections to arbitrary internal hosts and ports before authentication. This vulnerability enables blind internal port scanning and was fixed in version 6.0.2.
Adminer versions 6.0.0 and 6.0.1 are vulnerable to a pre-authentication Server-Side Request Forgery (SSRF) when the official ClickHouse driver plugin is loaded. An unauthenticated attacker can cause the server to send arbitrary HTTP POST requests to internal or external URLs, potentially disclosing sensitive internal information via error responses. This vulnerability is fixed in Adminer 6.0.2.
Adminer versions from 0 up to but not including 6.0.2 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver. This flaw allows an unauthenticated attacker to cause the server to make HTTP GET requests to arbitrary internal or external hosts by submitting crafted authentication parameters. The vulnerability enables internal network reconnaissance and service fingerprinting via error messages displayed on the login page. Exploitation requires the Elasticsearch driver to be explicitly enabled and PHP's allow_url_fopen setting to be active. The issue is fixed in Adminer version 6.0.2.
Adminer versions before 6.0.2 have a cross-site scripting (XSS) vulnerability caused by improper escaping of the CONNECTION_ID() database result in JavaScript. This flaw allows a malicious database server to execute arbitrary JavaScript in the context of the authenticated Adminer user. In deployments where the database has FILE privileges and can write to the webroot, attackers can leverage this XSS to submit authenticated SQL commands that write PHP files, potentially leading to remote code execution under the web server's account.
CVE-2026-100694 is a cross-site scripting (XSS) vulnerability in the Hugo static site generator affecting versions from 0.56.0 up to but not including 0.166.0. The issue arises because content files with the text/org media type are rendered without escaping raw HTML, allowing unescaped HTML to pass through Org export blocks and @@html:...@@ snippets. This can enable an attacker who controls or influences such content files to inject malicious scripts that execute in visitors' browsers. The vulnerability is fixed in version 0.166.0 by introducing a security.allowContent allowlist that denies text/org by default, requiring explicit opt-in for Org Mode content. Only sites that process text/org content are affected, and sites fully trusting their content sources are not impacted.
Hugo versions from 0.162.0 up to but not including 0.166.0 have a case-sensitive validation flaw in the security.http.urls IP-literal deny rule. This flaw allows attackers to bypass restrictions by using mixed-case URL schemes in resources.GetRemote calls, enabling fetching from restricted IP addresses such as localhost.
CVE-2026-100692 is a high-severity vulnerability in the Hugo static site generator affecting versions before 0.166.0. It involves improper link resolution before file access, allowing symlinks at mount roots in themes or vendored modules to expose files outside intended directories during site builds. This could lead to unauthorized reading and publishing of files outside the local theme or module paths. The issue is fixed in version 0.166.0 by treating symlinked mount roots and intermediate symlinked directories as non-existent. Modules fetched via Go modules are not affected due to their inability to contain symlinks. Users should inspect and remove symlinks in themes and vendored modules or upgrade to the fixed version.
A stored cross-site scripting (XSS) vulnerability exists in Hugo versions 0.75.0 through 0.165.x. The issue arises because the syntax highlighter does not properly escape the lineAnchors option before passing it to Chroma, which inserts the value directly into HTML attributes. This allows an attacker to inject arbitrary JavaScript into the generated pages if untrusted Markdown content is published. The vulnerability is fixed in version 0.166.0 by HTML-escaping the lineAnchors value before use.
CVE-2026-100690 is a high-severity vulnerability in Hugo versions 0.161.0 through 0.165.0 where symbolic links can escape the intended sandbox during Node.js tool execution. This allows an attacker who can contribute content to a Hugo project to create symlinks pointing outside the project directory, potentially exposing sensitive files such as /etc/passwd. The issue is fixed in version 0.166.0 by validating resolved symlink paths and failing builds that escape allowed directories.
An unauthenticated SQL injection vulnerability exists in the YouTube Gallery extension for Joomla versions 1.0.0 through 5.7.2. The flaw affects the video search and sorting functionality, allowing attackers to inject SQL commands in read queries. This vulnerability is classified as CWE-89 and has a critical severity rating with a CVSS 4.0 score of 9.3.