The Bot for Telegram on WooCommerce WordPress plugin versions up to and including 1.3.0 contains an authentication bypass vulnerability. An unauthenticated attacker can exploit a REST endpoint that lacks proper permission checks and signature verification to forge bot updates. This allows the attacker to impersonate any WordPress user by username and obtain a login token. The token can then be used to create an authenticated session cookie without any capability checks or nonces, enabling full account takeover, including administrator accounts.
openEQUELLA versions prior to 2026.2 have a stored cross-site scripting (XSS) vulnerability in the pre-login notice feature. The notice is stored as HTML and rendered on the legacy login page without proper encoding or sanitization. Users with the EDIT_SYSTEM_SETTINGS permission can inject arbitrary scripts via the pre-login notice API endpoint. If this permission is granted to guest or Everyone users, unauthenticated exploitation is possible.
openEQUELLA versions before 2026.1 contain a vulnerability in the pre-login notice image upload endpoint that allows users with EDIT_SYSTEM_SETTINGS permission to upload HTML files without proper type validation. These files are served with a Content-Type based on the filename, enabling stored cross-site scripting (XSS). If the permission is granted to unauthenticated users, exploitation can occur without authentication.
openEQUELLA versions before 2026.1 have a vulnerability in the GET /api/userquery/userinfobackup endpoint, which does not perform authentication or authorization checks. This allows an unauthenticated attacker to retrieve personal details such as username, first name, last name, and email address of any user within the same institution by supplying their uniqueId.
openEQUELLA versions before 2026.1 have a vulnerability in the SOAP API's stopEdit operation where XML parsing resolves external entities. This flaw enables attackers to read arbitrary files accessible by the service or perform server-side request forgery (SSRF). The vulnerability has a medium severity rating with a CVSS score of 6.1.
In openEQUELLA versions before 2026.1, the system.execute() function in the scripting engine allows execution of arbitrary operating system commands without validation or an allow-list. This enables users with script creation or editing privileges to run commands with the openEQUELLA service account's privileges, leading to a critical security risk.
openEQUELLA versions before 2026.1 contain a vulnerability in the XML parser used for item metadata. The parser does not disable external entity resolution, allowing a user with CREATE_ITEM permission to submit crafted XML to the POST /api/item endpoint. This can lead to the server reading arbitrary files accessible to the service or making server-side requests to attacker-specified locations, including cloud instance metadata services.
The Ortto plugin for WordPress versions before 1.0.25 improperly handled WooCommerce product data embedded in public storefront pages, allowing unauthenticated attackers to access product passwords and private metadata. This vulnerability could expose sensitive product information without requiring authentication.
The Ortto plugin for WordPress versions before 1.0.25 does not properly authenticate configuration update requests. It relies solely on a secret exposed in public HTML, allowing unauthenticated attackers to overwrite the plugin's configuration and serve arbitrary scripts.
An improper input validation vulnerability in Bixby versions prior to 4.0.85.6 allows privileged local attackers to launch arbitrary activities. This flaw affects local users with elevated privileges and can lead to unauthorized activity execution. The vulnerability has a high severity rating with a CVSS score of 8.3. No known exploits in the wild have been reported. The issue is fixed starting from version 4.0.85.6.
A security vulnerability in the nipy nibabel library up to version 5.4.2 affects the function array_from_file in nibabel/volumeutils.py. This flaw leads to uncontrolled memory allocation and can be exploited remotely. A fix has been proposed via a pull request but has not yet been accepted or released.
The Apache Struts 2 REST Plugin has a vulnerability where the @StrutsParameter authorization checks do not apply to members annotated with Jackson's @JsonAnySetter. This means that certain parameters may bypass intended authorization controls.
CVE-2026-42949 is an authorization bypass vulnerability in the /api/runscript endpoint of Frangoteam's FUXA product version 1.3.2-2809. This flaw allows an unauthenticated attacker to execute privileged operations by sending a specially crafted HTTP request. The vulnerability has a medium severity rating with a CVSS score of 5.6.
CVE-2026-40063 is an information disclosure vulnerability in the /nodered/fuxa/scripts functionality of Frangoteam's FUXA product version 1.3.2-2809. An unauthenticated attacker can send a specially crafted HTTP request to trigger this flaw and leak sensitive information.
CVE-2026-42922 is a critical authorization bypass vulnerability in the /nodered functionality of Frangoteam FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that can lead to arbitrary code execution on the affected system.
CVE-2026-118426 is a missing authorization vulnerability in Octopus Deploy Octopus Server when the LDAP authentication provider is enabled. Authenticated users can call LDAP user and group search functions without proper authorization. This issue affects specific versions prior to fixed releases 2026.2.13487 and 2026.3.15909. The vulnerability has a medium severity with a CVSS score of 5.3.
4NTL is a browser extension for Chromium-based browsers that enables quick threat intelligence lookups from the right-click menu. It allows users to check IPs, domains, URLs, or file hashes against VirusTotal and AbuseIPDB without leaving the current page. The extension is designed to improve analyst efficiency by reducing the need to copy and paste indicators into separate tabs. It respects user privacy by only querying VirusTotal and AbuseIPDB, never submitting new samples, and keeping API keys local to the browser profile. No active exploitation or vulnerabilities are reported in the extension itself.
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.