CVE-2026-108569 is a medium severity SQL injection vulnerability in Furion .NET Framework up to version 4.9.9.92. The flaw exists in the String.Replace function within the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs, where manipulation of the argument 'Name' can lead to SQL injection. Remote exploitation is possible, and public exploit code is available. The vendor has not responded to disclosure requests, and no patch or official remediation has been announced.
CVE-2026-108568 is a medium severity vulnerability in InstantSoft icms2 versions 2.18.0, 2.18.1, and 2.18.2. It involves insufficient verification of data authenticity in the validatePaypalOrder function of the Billing Module, specifically in the paypal.php controller. The flaw allows remote attackers to manipulate the bid/sig arguments, potentially bypassing data validation. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
A critical OS command injection vulnerability exists in OpenSpug Spug versions up to 3.4.0 and 4.0.1 in the file transfer component (/exec/transfer). This flaw allows remote attackers with low privileges to execute arbitrary OS commands without user interaction. The vulnerability has a high CVSS score of 9.9 and an exploit has been published. The vendor has not responded to disclosure requests and no patch information is available.
CVE-2026-108567 is a path traversal vulnerability in InstantSoft icms2 affecting versions 2.18.0, 2.18.1, and 2.18.2. It occurs in the files_delete_file function within the Image Handler component, allowing remote attackers to manipulate the size argument to traverse directories. The vulnerability has a medium severity with a CVSS score of 5.3. A patch identified by commit 03d70937f1ff97031523222808726994b8b79379 is available to fix this issue.
CVE-2026-108566 is a cross-site scripting (XSS) vulnerability in InstantSoft icms2 affecting versions 2.18.0, 2.18.1, and 2.18.2. The flaw exists in the Private Message Handler component, specifically in the index function of templates/default/controllers/messages/index.tpl.php, where manipulation of the 'nickname' argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. A patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 is available to address this issue. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
CVE-2026-108544 is a medium severity path traversal vulnerability in the Lippu Docx Reader Office Viewer App for Android, affecting versions 1.4.0 through 1.4.5. The flaw exists in the function word.office.docxviewer.document.docx.reader.ViewTxt, where manipulation of the _display_name argument can lead to unauthorized file path access. The vulnerability can be exploited remotely and requires user interaction. No official patch or remediation information is provided.
CVE-2026-108543 is a path traversal vulnerability in the ag2ai ag2 product affecting versions 0.13.0 through 0.13.4. The issue arises from improper handling of the filename argument in the os.path.join function within the UserProxyAgent component, allowing remote attackers to manipulate file paths. The vulnerability has a medium severity score of 5.3 and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation has been confirmed.
The npm package 'react-dropzone-v4' version 99.0.0 is a malicious package that mimics the popular 'react-dropzone' library. It contains a preinstall script that executes automatically during installation, which performs DNS and HTTP requests to a third-party domain, transmitting the installer's hostname without consent. The package provides no legitimate functionality and appears designed for dependency confusion attacks to capture host information.
CVE-2026-108542 is a server-side request forgery (SSRF) vulnerability in the 021is elvix-sdk affecting versions 0.10.0 and 0.10.1. The flaw exists in the MCP Request Handler component, specifically in the src/mcp/index.ts file, where manipulation of the path argument allows remote attackers to induce SSRF. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. The vendor was contacted but did not respond, and no patch or remediation is currently available.
A vulnerability in Studio-Saelix Sencho up to version 0.94.1 affects the login endpoint (/api/auth/login). It involves improper authentication due to manipulation of the X-Forwarded-For header, allowing an attacker to rotate the apparent client IP address. This flaw can be exploited remotely. A patch has been released to fix the issue by ignoring forwarding headers by default and only accepting them from explicitly configured proxy CIDRs, along with adding a separate failed-attempt limit keyed by normalized account identity.
A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.94.1 in the git-sources Browse API Endpoint. The vulnerability involves manipulation of the repo_url argument, potentially allowing an attacker with some privileges to induce the server to make unintended requests. The vendor disputes the severity and scope of the issue, noting that repository access is a privileged function and that no privilege boundary bypass or unprivileged access is demonstrated. The vendor has implemented hardening measures including DNS validation, rejection of certain network targets, and strict SSH host-key verification. The CVSS score is 4.3 (low severity). A patch identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 is available to address the issue.
CVE-2026-108541 is a SQL injection vulnerability in highwarden Super Store Finder versions 3.0 through 3.8. The flaw exists in an unknown function within /products/superstorefinder/index.php where the lat/lng parameters can be manipulated to execute SQL injection. Remote exploitation is possible. The vendor has released version 3.9 to fix this issue.
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.