CVE-2026-97307 is a vulnerability in StylemixThemes Cost Calculator Builder up to version 4.0.17 that allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This issue affects all versions from initial release through 4.0.17. The vulnerability has a high severity with a CVSS score of 7.5 and does not require user interaction or privileges to exploit.
CVE-2026-105145 is an information disclosure vulnerability in Weaviate Verba versions 2.1.0 through 2.1.3. The flaw exists in the get_environment function within the generate_stream endpoint component, allowing remote attackers to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 6.9. Although the exploit has been publicly disclosed, there is no indication of active exploitation in the wild. The vendor was contacted but has not responded or provided a patch.
CVE-2026-103344 is a reflected cross-site scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) up to version 2.0.20. It allows improper neutralization of input during web page generation, enabling attackers to execute malicious scripts in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-105144 is a path traversal vulnerability in the Drogon web framework affecting versions 1.9.13-1 and 10.0-beta.0 through 10.0-beta.3 on Windows. The flaw exists in the StaticFileRouter::route function, allowing remote attackers to manipulate file paths. Exploit code has been published, but there is no vendor response or patch available as of the disclosure date. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9.
A hard-coded credentials vulnerability exists in topoteretes cognee versions 1.5.0 through 1.5.4 in the JWT Signing Key Handler component. The flaw is due to manipulation of the FASTAPI_USERS_JWT_SECRET argument in the get_user_id_by_email function, allowing remote attackers to exploit hard-coded credentials. Upgrading to version 1.6.0 addresses this issue.
Post-quantum cryptography (PQC) standards were finalized by NIST in August 2024, replacing RSA and ECC for key exchange and digital signatures. While enterprise security teams are tracking PQC migration, most small and medium businesses (SMBs) and small SaaS companies are not, despite migration timelines spanning 3–10 years. This creates risk from adversaries who harvest encrypted data now to decrypt later once quantum capabilities mature. The urgency is especially high for organizations handling sensitive, long-lived data subject to regulations like HIPAA. A practical mitigation is to conduct a cryptographic inventory to identify asymmetric encryption usage, including in libraries and cloud defaults, and to consult vendor PQC roadmaps. Major cloud providers and OpenSSL have published PQC migration plans and experimental support. The migration at the TLS layer can often be done via configuration changes without code modifications.
CVE-2026-97276 is a reflected Cross-site Scripting (XSS) vulnerability in the VeronaLabs WP Statistics WordPress plugin, affecting versions up to and including 14.16.14. It allows improper neutralization of input during web page generation, which could enable attackers to execute arbitrary scripts within a user's browser session. This vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-103354 is a stored cross-site scripting (XSS) vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks. It affects versions up to and including 3.7.11.1. The flaw involves improper neutralization of input during web page generation, which could allow attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.
A vulnerability in the User Private Files WordPress plugin before version 2.2.0 allows unauthenticated users on multisite installations to access other users' private files. This occurs because the rewrite rule that enforces access control is bypassed, exposing private files directly. The issue is classified as improper access control (CWE-284).
CVE-2026-93549 is a high-severity cross-site request forgery (CSRF) vulnerability in the CoCart WordPress plugin versions 4.9.0 through 4.9.6. The plugin improperly scopes its REST API authentication filter, disabling WordPress core's REST nonce protection for all routes. This flaw allows an attacker to exploit a logged-in administrator's session to create a new administrator account via CSRF.
CVE-2026-86817 is an information exposure vulnerability in the Five Star Business Profile and Schema WordPress plugin versions 2.3.20 up to but not including 2.4.0. Authenticated users with Author-level access or higher can exploit improper callback restrictions to disclose sensitive data such as other users' password hashes and arbitrary site option values. This sensitive information can be exposed in publicly accessible output, making it readable by unauthenticated visitors. The vulnerability has a medium severity with a CVSS score of 4.9.
A stored Cross-Site Scripting (XSS) vulnerability exists in the Simple Shopping Cart WordPress plugin before version 5.2.6. This vulnerability arises because some settings field values are not properly escaped before being output on an admin settings page. It allows high-privilege users, such as administrators, to inject malicious scripts. The issue is particularly impactful on multisite WordPress installations where administrators lack the unfiltered_html capability.
A vulnerability in the Razorpay for WooCommerce WordPress plugin before version 4.8.8 allows unauthenticated attackers to modify shipping information on arbitrary orders via a REST API route that lacks proper ownership or authorization checks.
The Horizontal scrolling announcements WordPress plugin up to version 2.6 contains a stored Cross-Site Scripting (XSS) vulnerability. This occurs because one of its announcement settings is not properly sanitized or escaped before being output into an attribute context on the front end. Users with Contributor or higher privileges who have access to the announcement management page can inject malicious scripts. These scripts execute in the browsers of anyone viewing the affected announcements, potentially compromising confidentiality, integrity, and availability.
A critical OS command injection vulnerability exists in Ahsay AhsayCBS versions 10.3.0, 10.3.1, and 10.3.2. The flaw is in the Replication Receiver component, specifically in the /rps/api/json/UpdateReceivers.do endpoint, where manipulation of the 'random' argument can lead to remote command execution. Exploit code has been published. Upgrading to version 10.3.4 resolves the issue.
Dulwich's porcelain.checkout(paths=[...]) function uses raw os.open calls that follow symlinks, bypassing symlink protections and allowing arbitrary file writes. An attacker can craft a malicious repository with symlinks that cause checkout to overwrite files such as .git/hooks/post-checkout, enabling remote code execution on subsequent git operations. The vulnerability affects Poetry versions from 2.2.0 up to but not including 2.4.2. A patch is available to fix this issue by replacing the raw os.open usage with a safer method that detects symlinks.
Dulwich's stash pop function in version 1.2.7 is vulnerable to a symlink directory traversal that allows an attacker to write arbitrary files outside the repository worktree. This occurs because the function uses os.path.exists() which follows symlinks, enabling writes through malicious intermediate symlinks. An attacker can craft a repository that, when a victim pops a stash, writes attacker-controlled files such as .git/hooks/post-checkout, leading to remote code execution on the victim's machine during subsequent git operations. A patch is available to mitigate this issue by verifying symlink resolution before writing files.
A denial of service (DoS) vulnerability exists in the dulwich library's Pack.resolve_object method. When resolving an OFS_DELTA object with a delta_offset of zero, the method enters an infinite recursive loop due to self-referential offset calculation. This causes CPU exhaustion and process crashes in applications using dulwich for Git packfile operations. The vulnerability affects dulwich versions >=1.2.0 and <2.4.2. A patch is available to explicitly reject delta_offset == 0 and prevent infinite recursion.
Dulwich's filter_branch.py in Poetry versions 2.2.0 up to but not including 2.4.2 contains a symlink directory traversal vulnerability in the CommitFilter._apply_index_filter() function. This occurs because materialized tree entries, including symlinks, persist in the working directory between commits, allowing an attacker to redirect file writes to arbitrary filesystem locations. An attacker can exploit this by crafting a malicious repository that causes filter_branch to write attacker-controlled content to arbitrary locations, potentially achieving remote code execution if writes target .git/hooks/. A fix is available that involves cleaning the working directory between commit iterations or verifying symlinks before writing files.