CVE-2026-101009 is a critical OS command injection vulnerability in aaPanel BaoTa up to version 11.8.0. It affects the Unzip Handler component, specifically the panelTask.bt_task._unzip function in the file /www/server/panel/class/panelTask.py. The vulnerability arises from improper handling of the Password argument, allowing remote attackers to execute arbitrary OS commands. The exploit has been publicly disclosed, but no vendor response or patch has been provided.
A stored cross-site scripting (XSS) vulnerability exists in the Tabs & Accordions (Free, Pro) extension for Joomla versions 2.3.0 through 3.1.0. The vulnerability arises from improper neutralization of input in the data-rlta-url attribute, which is used to generate URLs that are passed to window.open() in the browser. This allows execution of JavaScript via crafted URL schemes. The issue is due to the extension not rejecting dangerous browser URL schemes, leading to executable behavior when rendering articles.
A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Two critical Citrix NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) have been actively exploited in zero-day attacks. These flaws allow unauthenticated remote code execution on vulnerable NetScaler appliances, with one affecting all default configurations and the other requiring DTLS enabled. CISA has mandated U.S. federal agencies to patch these vulnerabilities by September 30, 2026. Citrix has released security updates and provided indicators of compromise, though these IoCs may have limited forensic value. The vulnerabilities also include potential denial of service, HTTP request smuggling, policy bypass, and TCP sequence number prediction under certain conditions. Over 23,000 NetScaler devices are exposed on the internet, increasing risk. Citrix and CISA strongly urge immediate patching and forensic investigation if compromise is suspected.
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.
CVE-2026-101006 is a medium severity vulnerability in Frappe HR up to version 16.15.0. It involves incorrect authorization in permission validation functions related to expense claims, shift requests, and attendance requests. The flaw allows remote attackers to manipulate the 'employee' argument to bypass authorization checks. The vendor has confirmed that this issue has been fixed based on prior reports.
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrade the affected component.
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be initiated remotely. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check. In versions 4.9.5.7 - 4.10.10 a guard present but only enforced when CACHE_REVALIDATION_TOKEN is set. Default deployments remain unprotected. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-101003 is a stack-based buffer overflow vulnerability in Cesanta Mongoose versions 7.0 through 7.21. It affects the MQTT Broker component, specifically the function 'fn' in the file tutorials/mqtt/mqtt-server/main.c. The vulnerability can be exploited remotely without authentication or user interaction. A public exploit is available. Upgrading to version 7.22 resolves this issue.
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-101000 is a critical vulnerability in Netcore NBR100V2 version 1.3.240614.030928. It involves missing authorization in the ACL Handler component, specifically in the uci.apply function of the /usr/share/rpcd/acl.d/unauthenticated.json file. This flaw allows remote attackers to manipulate arguments and bypass authorization controls. The vulnerability has a maximum CVSS score of 10, indicating severe impact. The vendor has not responded to the disclosure, and no patch or mitigation guidance is currently available. Exploit code has been publicly disclosed, but there are no confirmed reports of exploitation in the wild.