Threat database

CVE-2026-68497 is a denial of service vulnerability in the jackson-databind library caused by unbounded numeric parsing. This vulnerability allows an attacker to cause a CPU resource exhaustion, leading to a denial of service condition. The issue affects multiple specific versions of jackson-databind. Red Hat and SUSE have issued security advisories and updates addressing this vulnerability. The vulnerability has a CVSS 3.1 score of 7.5 (medium severity). No known exploits are reported in the wild at this time.

CVE-2026-103685 is a missing authorization vulnerability in the VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin. It affects versions from the initial release up to 2.2.4. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3. No official patch or remediation information is provided in the available data.

TabularisDB's tabularis version 0.27.0 and earlier contains an incorrect authorization vulnerability in the MCP run_query safety gate. This flaw allows untrusted or prompt-injected agents to bypass read-only mode by submitting side-effecting SELECT statements, enabling unauthorized data modification. Attackers can exploit this to run PostgreSQL functions like setval, nextval, or query_to_xml with embedded DELETE commands without approval prompts.

slide-maker versions up to 5.8.0 have a path traversal vulnerability in the generate_images_openai.py component. This flaw allows attackers to write image files outside the intended output directory by manipulating filenames in the image prompt manifest. By including '../' sequences or symlinked filenames, attackers can create directories or overwrite files at arbitrary filesystem locations.

CVE-2026-27350 is a Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius affecting versions from 1.4 through 1.4-beta. This vulnerability allows an attacker to induce the server to make unintended requests. The CVSS score is 7.2, indicating a high severity with potential impact on confidentiality and integrity but no impact on availability. No official patch or remediation details are provided in the available data.

CVE-2026-97853 is a memory allocation vulnerability in the ericmj decimal library affecting versions from 0.1.0 up to but not including 3.1.2. The Decimal.round/3 function allocates memory proportional to the 'places' argument before applying context precision, allowing excessive memory use. For example, calling Decimal.round with a large negative places value can allocate multiple gigabytes of memory, potentially causing denial of service by exhausting system memory and terminating the BEAM VM. This issue arises when user-supplied decimal places are not properly bounded.

CVE-2026-66480 is a vulnerability in YITH WooCommerce Product Add-Ons that allows unauthorized exposure of sensitive system information. This issue affects versions up to and including 4.34.0. The vulnerability does not require privileges or user interaction to exploit and has a medium severity rating based on a CVSS score of 5.3.

CVE-2026-57742 is a high-severity reflected cross-site scripting (XSS) vulnerability in ThemeREX Group's Kids Planet product. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability affects versions up to and including 2.2.14.2. No patch or remediation information is currently provided.

CVE-2026-107434 is a medium severity vulnerability in videowhisper MicroPayments versions up to 3.2.9. It involves improper validation of specified quantity in input, leading to a subscriber bypass issue. This flaw could allow an attacker with low privileges to cause limited integrity and availability impacts without user interaction.

CVE-2026-107420 is a medium severity vulnerability affecting Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway versions up to 1.7.2. It involves insufficient verification of data authenticity, allowing unauthenticated bypass. This could lead to integrity issues but does not impact confidentiality or availability.

CVE-2026-81797 is a critical vulnerability in the ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme version 1.0.2 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-78535 is a critical vulnerability in ThemeRex Photolia versions up to 1.0.3 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-78534 is a high-severity cross-site scripting (XSS) vulnerability affecting Keen IT Solutions Educavo versions up to and including 3.4.2. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No specific patch or remediation information is provided in the available data.

CVE-2026-78533 is a critical vulnerability in AncoraThemes Qwery versions up to and including 3.6.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.

CVE-2026-78532 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting designthemes LMS versions up to and including 8.3. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability can be exploited without authentication and impacts confidentiality, integrity, and availability. No specific patch or remediation details are provided in the available data.

CVE-2026-78531 is a critical vulnerability in ThemeREX Jacqueline versions up to 2.22 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-78530 is a path traversal vulnerability in Chimpstudio FoodBakery versions up to 4.6 that allows subscribers to delete arbitrary files. This vulnerability can lead to denial of service by impacting availability. It requires network access with low complexity and privileges of a subscriber-level user. No patch information is currently provided.

CVE-2026-78529 is a critical vulnerability in ThemeREX Alliance versions up to and including 3.11. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.

CVE-2026-66569 is a critical vulnerability in axiomthemes Kicker versions up to 2.2.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-66568 is a critical vulnerability in axiomthemes Original versions up to 1.9.0 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.