CVE-2026-106608 is a high-severity vulnerability in Automattic WooCommerce versions from 9.8.0 up to but not including 11.2.0. It involves incorrect privilege assignment that allows privilege escalation. The vulnerability has a CVSS 3.1 score of 7.2, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Patch status is not confirmed as no patch or vendor advisory is provided.
CVE-2026-106609 is a high-severity vulnerability in the Bayarcash WooCommerce plugin by Web Impian. It involves missing authorization controls, allowing unauthorized users to exploit incorrectly configured access control security levels. This affects versions from initial releases up to 4.4.2 inclusive. The vulnerability does not impact confidentiality but allows unauthorized modification of data, with no impact on availability. No known exploits are reported in the wild, and no official patch information is provided.
CVE-2026-94160 is a high severity reflected cross-site scripting (XSS) vulnerability in ThemeStek Extras for LabtechCO Theme. It affects versions from 0 up to and including 8.4. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can be executed in the context of a user's browser session.
CVE-2026-62044 is a deserialization of untrusted data vulnerability in bPlugins Super Video Player up to version 1.8.13. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 7.2. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
1MCP Agent versions 0.20.0 through 0.39.0 have an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement. By using negated advanced tag-filter expressions, attackers with a single-tag token can access backend MCP server tools beyond their authorized scopes. This vulnerability has a medium severity rating with a CVSS score of 5.3.
argocd-mcp versions up to 0.9.0 contain a path traversal vulnerability in the delete_application tool. This flaw allows authenticated MCP clients to manipulate the applicationName parameter with dot-segment values to access unintended API endpoints. Exploitation can lead to deletion of repositories, clusters, or projects within the scope of the token's RBAC permissions. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
zotero-mcp versions 0.10.0 through 0.14.1 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to manipulate the _fetch_embedded_metadata function to fetch URLs without validating the destination, potentially accessing internal services. Attackers can use prompt injection to trigger zotero_add_by_url, causing requests to internal or link-local hosts, which may leak citation metadata and error information. The vulnerability has a low severity score and no known exploits in the wild.
GenOffice versions up to 0.11.505 have an incorrect permission assignment vulnerability in the HTTP MCP server file store. This flaw allows local unprivileged users to read uploaded and generated documents by accessing a world-readable directory under the system temporary folder. The vulnerability bypasses HTTP bearer token protections, exposing client uploads and converted outputs to unauthorized local users.
TencentCloud Octop versions up to 1.0.2b6 have a missing authorization vulnerability that permits authenticated low-privileged users to access stored provider API keys. The flaw allows these users to retrieve plaintext LLM and voice provider API keys by querying specific API endpoints that only validate JWT tokens without proper authorization checks.
AniWorld Downloader versions before 5.3.0 have a vulnerability in the WebUI login handler that allows unauthenticated attackers to perform unlimited authentication attempts without throttling. This flaw enables attackers to enumerate usernames based on response timing and brute-force passwords to potentially take over user accounts.
OpenPanel versions up to 2.3.0 have a CSV formula injection vulnerability. This flaw allows unauthenticated attackers to inject spreadsheet formulas via crafted profile IDs sent to the /track endpoint. When cohort data is exported to CSV, these formulas can execute, potentially exfiltrating adjacent cell data. The vulnerability has a low CVSS score of 2.3 and does not require privileges to exploit.
PDFMathTranslate (pdf2zh) versions up to 1.9.11 have a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The vulnerability arises because the translate_file handler forwards user-supplied URLs to a download function without validating the scheme or address. This can enable attackers to access internal services and cloud metadata endpoints and retrieve PDFs returned by those services.
SillyTavern versions 1.12.13 through 1.19.0 have a denial of service vulnerability due to the body-parser middleware processing large request bodies before authentication and whitelist checks. This allows unauthenticated remote attackers to send large or compressed JSON or urlencoded payloads, up to 500 MB, potentially in parallel, to exhaust server memory and CPU resources, causing service disruption.
Open Source Social Network (OSSN) versions through 10.1 have an insecure direct object reference (IDOR) vulnerability in the ossn_com.php component of OssnMessages. This flaw allows authenticated users to access private message attachments of other users by requesting attachments via the /messages/attachment/{guid} endpoint without proper sender or recipient verification. The vulnerability enables unauthorized reading of private message attachments.
FusionPBX versions through 5.6.5 contain an OS command injection vulnerability in the call_recordings::download() function. This flaw allows unauthenticated attackers to execute arbitrary commands by placing calls with malicious caller ID values that include shell metacharacters. When the record_name filename template is enabled, these commands execute as the web server user when a privileged user downloads multiple recordings as a ZIP archive. The vulnerability has a high severity score of 7.5 CVSS 3.1.
Strapi versions 5.47.0 through 5.57.0 have an improper authorization vulnerability (CVE-2026-108114) where admin API tokens retain full Content Manager access even after the owner's role is restricted. This occurs because the reconciliation process ignores token permissions with omitted or null fields, allowing token holders to access content fields removed from their role.