Threat database

CVE-2026-110360 is a missing authorization vulnerability in WPdreams Ajax Search Lite plugin versions before 4.14.6. It allows unauthorized access due to incorrectly configured access control. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability.

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

CVE-2026-110378 is a missing authorization vulnerability in the WP E-Signature Ninja Forms Signature Contract Add-On. It affects versions from initial releases up to but not including 3.2.5.1. The flaw allows unauthorized access due to incorrect access control configuration. The vulnerability has a medium severity with a CVSS score of 5.3, indicating a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to information disclosure without integrity or availability effects. No patch or remediation details are provided in the available data.

CVE-2026-96449 is a missing authorization vulnerability in the WPExperts WP EasyPay plugin affecting versions from initial release up to 4.5.4. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.

Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.

CVE-2026-110381 is an authorization bypass vulnerability in NSquared Simply Schedule Appointments that arises from user-controlled keys allowing incorrect access control. It affects versions from initial releases up to but not including 1.6.12.37. The vulnerability has a medium severity with a CVSS score of 6.3, indicating a network attack vector with low attack complexity but requiring privileges. It impacts confidentiality, integrity, and availability at a low to medium level. No known exploits are reported in the wild, and no official patch information is provided.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.

CVE-2026-110888 is a missing authorization vulnerability in Meow Apps AI Engine versions prior to 3.8.4. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-110891 is a missing authorization vulnerability in WordLift by WordLift Srl. It affects versions from the initial release up to 3.54.16. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to limited confidentiality and integrity impacts without user interaction. The CVSS score is 5.4, indicating a medium severity level.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

This content discusses the importance of contextual defense in modern cybersecurity, emphasizing how connecting disparate signals and understanding the context around events can help security teams anticipate and stop cyberattacks before they escalate. It highlights the challenges of data fragmentation and the need for integrated, context-aware security systems that assess multiple signals collectively rather than isolated alerts. The article advocates for a shift from reactive to proactive defense strategies, leveraging frameworks like the OODA loop to improve detection and response. It also outlines practical steps for implementing contextual security, including auditing data quality, defining clear authority boundaries, ensuring visibility and reversibility of automated actions, and planning for scalable infrastructure.

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

NL Portal Backend Libraries versions prior to 3.0.3 contain an improper authorization vulnerability. Authenticated users can access documents belonging to other users via specific GraphQL and REST API endpoints without proper ownership checks. Document identifiers are random but may leak through other means, exposing potentially sensitive personal information. This issue is resolved in version 3.0.3.

CVE-2026-103936 is a high-severity vulnerability in the JavaScript libp2p networking stack prior to version 6.0.28. The issue arises in the @libp2p/webrtc webRTCDirect() Node.js listener, which processes unauthenticated STUN Binding Requests before completing peer authentication and connection setup. A crafted short ICE password derived from the STUN request causes an uncaught native invalid_argument exception in node-datachannel or libdatachannel, leading to process termination (SIGABRT). This denial of service vulnerability does not affect confidentiality, integrity, or allow code execution. The issue is fixed in libp2p version 6.0.28.

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.