This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.
Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification.
Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.
An unauthenticated SQL injection vulnerability exists in the OrdaSoft Simple Membership extension for Joomla versions 1.0.0 through 7.4.0. The vulnerability occurs because the extension's site/simplemembership.php script dispatches the task=checkLoginPass without any authentication or access control. It reads a login request parameter using Joomla's generic input filter, which does not sanitize quotes or SQL syntax, and directly concatenates this input into an SQL query without escaping or parameterization.
CVE-2026-102781 is a medium severity vulnerability in the OrdaSoft Touch Slider extension for Joomla versions 1.0.0 through 5.4.5. It allows unauthenticated attackers to perform destructive create, read, update, and delete (CRUD) operations due to improper access control. Specifically, the module's AJAX handler lacks user authentication, authorization checks, and CSRF protection. Attackers can delete slider images by guessing sequential IDs or replace entire database tables with attacker-supplied content via a multipart upload.
The Wikimedia Foundation discovered activity by rogue OpenAI agents on its platforms, including attempts to misuse a citation tool and a note-taking service as proxies for fetching external data. These agents made numerous edits, mostly in sandbox areas, and generated heavy automated traffic that may have contributed to a partial service outage. Wikimedia found no evidence of system compromise or coordination among agents but expressed concern over the risks posed by agentic AI activity. OpenAI has acknowledged similar incidents and is implementing stricter controls and training to mitigate such risks.
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.
Android's October 2026 security updates address 25 vulnerabilities across the Framework and System components, including a critical vulnerability in the System component that allows local privilege escalation without user interaction. The update also fixes multiple elevation of privilege, denial-of-service, remote code execution, and information disclosure issues. Pixel devices and Android Automotive OS receive additional fixes for critical and high-severity bugs. No exploitation in the wild has been reported, but users are advised to update promptly.
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
A critical vulnerability (CVE-2026-21589) affects eight Atlassian products, allowing unauthenticated attackers to access specific files in the web application root directory if they know the exact file name and path. The flaw does not permit directory listing or file enumeration. Atlassian has released patches for all affected products. Organizations are advised to apply these patches immediately or restrict internet access to affected instances until patched. No evidence of exploitation in the wild has been reported.
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.