CVE-2026-108921 is a medium severity vulnerability in the KusalkaSilva Learning-Management-System affecting the remove_announcements.php component. It involves missing authentication in the mysql_query function when manipulating the ID argument, allowing remote attackers to perform unauthorized actions. The product uses a rolling release model, so specific affected versions are not provided. The vulnerability is publicly known, but no vendor response or patch is available yet.
Temporal Server versions 1.30.0 through 1.30.7, 1.31.0 through 1.31.3, and 1.32.0 are affected by an authorization bypass vulnerability in Scheduler V2. An authenticated user with write permission in one namespace can manipulate schedule state in another namespace by exploiting internal completion callbacks that are not properly bound to namespaces. This can cause schedules to incorrectly record actions as completed or pause schedules improperly. No workflow payload or history disclosure is involved. Scheduler V2 is off by default, and only namespaces with Scheduler V2 schedules are vulnerable.
CVE-2026-104355 is a high-severity authorization vulnerability in Temporal Technologies, Inc.'s Temporal Server affecting multi-cluster deployments. A connected peer cluster can modify local namespaces on another cluster without proper authorization because the receiving cluster applies inbound namespace replication updates without verifying if the namespace is global. This allows a compromised or malicious peer to overwrite namespace metadata such as state, description, retention, and active cluster settings, potentially disrupting workflow operations. Clusters without remote clusters registered with connection enabled are not affected.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a vulnerability that can lead to denial of service when inserting data into tables with XML columns under specific conditions. This issue is due to allocation of resources without limits or throttling. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-87744 is a critical vulnerability in the Red Hat build of Quarkus 3.27.6.redhat affecting the REST Data Panache component. It allows unauthenticated attackers to bypass security controls on generated endpoints when developers customize operations using @MethodProperties without re-declaring security roles. This causes the code generator to drop class-level security requirements, resulting in endpoints defaulting to permissive, unauthenticated access. This can lead to unauthorized information disclosure or data modification.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a high-severity privilege escalation vulnerability (CWE-269) when the db2locssh feature is enabled with the Db2 instance. This vulnerability allows an attacker with limited privileges to escalate their privileges, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-78404 is a local privilege escalation vulnerability in IBM Db2 affecting versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. The issue arises from improper privilege management in the db2pd utility, allowing a local attacker with limited privileges to escalate to higher privileges. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. There are no known exploits in the wild and no vendor-provided patch information is currently available.
CVE-2026-59976 is a path traversal vulnerability in C4illin ConvertX, a self-hosted file conversion service. Versions prior to 0.18.0 use an unsanitized convert_to parameter in the ImageMagick converter, allowing directory traversal sequences to escape the intended output directory. This can enable authenticated users, or unauthenticated users if access is allowed, to write converted files to arbitrary paths, potentially overwriting files or causing denial of service. The issue is fixed in version 0.18.0.
CVE-2026-59977 is a Cross-Site Request Forgery (CSRF) vulnerability in C4illin ConvertX, a self-hosted file conversion service. Versions prior to 0.18.0 have a /delete/{id} endpoint that uses HTTP GET for permanent deletion without CSRF protection. An authenticated user visiting attacker-controlled content can trigger deletion of converted-file history without authorization. This issue is fixed in version 0.18.0.
AsyncHttpClient versions from 2.1.0 up to 2.16.1 and 3.0.0 up to but not including 3.0.14 have a session fixation vulnerability in the default ThreadSafeCookieStore. This flaw allows Secure cookies received over plaintext to be accepted and insecure cookies to overwrite or delete existing Secure cookies, enabling an attacker to manipulate cookie state sent to HTTPS origins. The issue is fixed in version 3.0.14.
CVE-2026-104102 is a path traversal vulnerability in the FTP and FTPS server components of copyparty before version 1.20.19. It allows uploading files to any directory writable by the copyparty process when FTP or FTPS is explicitly enabled. The vulnerability does not allow reading or overwriting existing files, and filenames have randomized suffixes. It cannot be used to execute code directly via copyparty. The main risk is that uploaded files might affect other software on the same system if that software executes files in writable directories.
A missing authorization vulnerability exists in RocketGeek WP-Members plugin (up to version 3.5.7) that allows exploitation of incorrectly configured access control security levels. This vulnerability can lead to unauthorized access with limited privileges. The issue is tracked as CVE-2026-61994 and has a medium severity rating with a CVSS score of 5.4.
A race condition vulnerability (CWE-362) exists in Pixelite Events Manager up to version 7.4.7, involving concurrent execution using a shared resource with improper synchronization. This flaw allows leveraging race conditions that may lead to limited integrity impact without affecting confidentiality or availability. The vulnerability has a low CVSS score of 3.7 and requires network attack vector with high attack complexity and no privileges or user interaction. No known exploits are reported in the wild, and no patch information is currently available.
A critical command injection vulnerability (CVE-2026-108918) exists in Edimax BR-6208AC firmware version 1.32. The flaw is in an unknown function related to the /goform/formWlanMP endpoint, where manipulation of the readE2P argument allows remote attackers to execute arbitrary commands. The exploit code is publicly available. The vendor has not responded and the affected product is no longer supported.
CVE-2026-107862 is a DOM-based Cross-site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin versions up to 11.2.7. It arises from improper neutralization of input during web page generation, allowing potentially malicious scripts to execute in the context of a user's browser. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A command injection vulnerability exists in Edimax BR-6208AC version 1.32 in the /goform/formAccept endpoint via manipulation of the submit-url argument. This vulnerability can be exploited remotely without authentication. The affected product is no longer supported by the vendor, and no patch or remediation has been provided. Public exploit code is available, increasing the risk of exploitation.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Patreon WordPress plugin 'patreon-connect' affecting versions up to 1.9.17. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability has a high severity with a CVSS score of 8.1.
A buffer overflow vulnerability exists in Edimax BR-6208AC firmware version 1.32, specifically in the /goform/formWlanMP endpoint via manipulation of the ateBW argument. This vulnerability can be exploited remotely and has a high severity score of 9.9. The vendor no longer supports this product and has not responded to disclosure attempts. Public exploit details are available, increasing the risk of exploitation.
A missing authorization vulnerability exists in WPMU DEV Forminator plugin versions up to 1.58.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality. There is no indication of integrity or availability impact. No official patch or remediation details are provided in the available data.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Patreon WordPress plugin 'patreon-connect' affecting versions up to 1.10.0. This vulnerability allows an attacker to trick a user into submitting unwanted requests, potentially causing denial of service. The vulnerability has a CVSS score of 7.4, indicating high severity, primarily due to its impact on availability. No patch or remediation information is currently provided.