CVE-2026-62040 is a missing authorization vulnerability in the DEV Institute Restrict User Access – Membership Plugin with Force. It affects versions from initial release up to 2.8.1. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation details are provided in the available data.
CVE-2026-62042 is a missing authorization vulnerability in unFocus Projects' Scripts n Styles product, affecting versions from 0 up to and including 3.5.8. The flaw allows unauthorized users to exploit incorrectly configured access control security levels. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating limited impact on confidentiality and no impact on integrity or availability.
CVE-2026-107419 is a missing authorization vulnerability in the Cool Plugins AI Translation for Polylang plugin, affecting versions from initial release up to 1.6.2. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5.4. No official patch or remediation details are provided in the available data.
A Ukrainian-Russian dual citizen has pleaded guilty to operating a large-scale money mule network that facilitated laundering millions of dollars for cybercriminals globally. The network involved approximately 15,000 money mules who helped move illicit funds obtained through cybercrime activities.
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 have a vulnerability where StaxUtils does not limit the total number of XML elements or characters by default. This can lead to excessive memory and CPU usage during XML parsing, potentially causing a denial of service. The issue is fixed by introducing default limits on element count and document size in the specified versions.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 contain a vulnerability in the Netty-based HTTP client transport where the hostname in the server's TLS certificate is not verified against the host being called. This flaw affects both HTTP/1.1 and HTTP/2 connections and allows a network attacker who can intercept traffic to impersonate the target service by presenting any trusted certificate. This can lead to reading or modification of exchanged messages, including credentials. Upgrading to fixed versions is recommended.
Apache CXF contains a vulnerability in its multipart/MTOM attachment part header parser where configured limits on header size and count are not fully enforced. This allows a remote unauthenticated attacker to send specially crafted multipart requests with very large folded or repeated headers, causing unbounded memory allocation and resulting in a denial of service. Versions prior to 4.2.4, 4.1.9, and 3.6.13 are affected. Upgrading to these fixed versions mitigates the issue.
CVE-2026-100227 is a high-severity vulnerability in Apache CXF's JAX-RS XML Security module involving improper verification of cryptographic signatures. The affected XML Signature interceptors did not ensure that the XML content passed to the application was fully covered by the signature, allowing an attacker to wrap a signed document inside unsigned content that the application would mistakenly treat as signed. This issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
Apache CXF contains a vulnerability in the STSTokenValidator component where the validation result of a SAML assertion signed by a trusted certificate is stored in a shared object accessible by all requests. This allows a remote, unauthenticated attacker to send a forged assertion signed with an untrusted certificate that could be mistakenly accepted as trusted during concurrent request processing. The issue affects services using STSTokenValidator without the alwaysValidateToSts setting enabled. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address this vulnerability.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 contain a vulnerability in the STSTokenValidator and Security Token Service (STS) where validated security tokens are cached using a non-cryptographic 32-bit hash. This allows an attacker to craft a token that collides with a cached hash, bypassing password validation and signature verification, potentially authenticating as another user and obtaining STS-signed tokens for that identity. The issue is fixed in versions 4.2.4, 4.1.9, and 3.6.13.
Apache CXF's FIQL query parser has a vulnerability where it can consume excessive CPU resources when processing long strings without operators. This can lead to denial of service by slowing or stopping other requests. The issue is fixed by limiting FIQL expressions to 4 KiB by default. Users should upgrade to versions 4.2.4, 4.1.9, or 3.6.13 or later to mitigate this risk.
Apache CXF contains an open redirect vulnerability in its OIDC relying-party component that allows redirection to attacker-controlled URLs after authentication. This occurs because state parameters controlled by an attacker are used as redirect targets without proper validation. Both directly and double-encoded URLs can exploit this issue. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address this vulnerability.
CVE-2026-78384 is a high-severity vulnerability in Apache CXF where the CompressionUtils.inflate() method decompresses attacker-controlled DEFLATE data without limiting the output size. This can cause a small crafted payload to expand to gigabytes on the heap, potentially leading to resource exhaustion. The flaw is exploitable via JWE decryption with zip=DEF and SAML redirect/POST binding token inflation, both occurring before trust validation. Fixed versions include 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable maximum inflated-size cap to prevent excessive memory usage.
CVE-2026-73179 is a high-severity race condition vulnerability in Apache CXF's JPA OAuth2 authorization code grant provider. It allows a remote attacker to obtain multiple valid access tokens from a single authorization code by exploiting a time-of-check to time-of-use (TOCTOU) flaw in the non-atomic find-then-delete operation under READ_COMMITTED isolation. This issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.