Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.
Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.
Atlassian's October 2026 security bulletin addresses 75 unique vulnerabilities affecting its Data Center and Server products, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. Among these, 14 are critical-severity issues primarily in third-party components such as Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD. Atlassian assesses the risk from these third-party component vulnerabilities as lower and non-critical for their products. The bulletin includes a variety of issues such as denial-of-service, cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure, and code execution bugs. Atlassian recommends updating to the latest product versions or fixed releases to mitigate these vulnerabilities. There is no indication of active exploitation in the wild for these issues.
CVE-2026-4952 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (AuftragsManager) version 7.0.8.6 and earlier. Authenticated users can inject JavaScript code into a business reference field via the ASMobile web interface. This code executes when a privileged user views the order in the OrderAdministration portal, potentially leading to privilege escalation or session compromise. The vulnerability has a medium severity score of 5.1 and affects versions up to 7.0.8.6. No patch or remediation information is provided by the vendor.
CVE-2026-4951 is a cross-site scripting (XSS) vulnerability in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem. It allows an attacker to inject JavaScript code via the "searchValue" URL parameter, which executes in the browser of a privileged user who opens a crafted link. This can lead to account takeover or user lockout since administrative users can change passwords without needing the old password. Version 7.0.8.6 and earlier versions are affected. The vulnerability has a medium severity score of 5.1. No patch or remediation information is currently available from the vendor.
CVE-2026-4950 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) portal. Privileged users can inject JavaScript code into user properties such as the "secondName" parameter. This code is stored and executed in the browsers of other privileged users viewing the affected user entries or user group overviews. The vulnerability affects versions from 0 up to and including 7.0.8.6. It requires authenticated access with high privileges and user interaction to trigger. No patch or remediation information is provided by the vendor.
CVE-2026-63244 is a critical authentication bypass vulnerability in WizLearn Technologies' Learning Management System. It allows an unauthenticated remote attacker to bypass both password and OAuth authentication by sending a specially crafted POST request. Successful exploitation could lead to unauthorized access to user accounts and full administrative control of the LMS platform.
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in
administrator into visiting a phishing website, causing the router to execute
arbitrary commands with root privileges.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
CVE-2026-63243 is an authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana devices (V2, V2X, SE). This flaw allows an attacker within Bluetooth range to connect to the affected device without prior pairing or authentication. The vulnerability affects version 1.30.260813.1100 of the product. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with low attack complexity and no user interaction required. There is no indication of a patch or vendor advisory specifying remediation status. No known exploits are reported in the wild.
CVE-2026-55981 is a critical firmware verification vulnerability affecting Creative Labs Creative Sound Blaster Katana V2, V2X, and SE devices. The flaw allows an attacker to modify a legitimate firmware image and upload the altered firmware to the device without proper verification. This can lead to complete compromise of the device's confidentiality, integrity, and availability.
The Iranian state-sponsored APT group known as Prince of Persia resumed operations in 2026 after a three-month pause coinciding with the Iran-US-Israel conflict. The group deployed a new Tornado malware command-and-control (C&C) server hosted in the United States for the first time since 2016, using shared hosting services rather than virtual private servers. Prince of Persia targets Iranian dissidents and government and private entities in the US, Europe, and the Middle East. The group uses malware capable of stealing files via Telegram bots. Semperis researchers have shared indicators of compromise and recommend monitoring for related activity.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator.
This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.