Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6.

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.

Red Hat has issued a security update for osbuild-composer, a service used to build customized OS artifacts such as VM images and OSTree commits. The update addresses multiple denial of service vulnerabilities and a man-in-the-middle vulnerability in various Golang components used by osbuild-composer. These vulnerabilities include issues in MIME header parsing, gRPC request handling, HTTP Range header processing, TLS extension handling, multipart form parsing, HTTP/2 SETTINGS frame processing, and certificate validation. The update is rated as important by Red Hat and applies to Red Hat Enterprise Linux 9.2 and related variants.

CVE-2026-118091 is a missing authorization vulnerability in WPFunnels, affecting versions from initial releases up to 3.13.5. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data or functionality. The issue is fixed in version 3.13.6.

The npm package 'cjlowuxbnexkhgpzq' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, risking exposure of all stored secrets and keys. Immediate removal of the package is advised, but due to potential full control by an attacker, removal alone may not eliminate all malicious components.

The npm package 'bcxhdh1kjlopsde' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.

CVE-2026-116387 is a Missing Authorization vulnerability in Brainstorm Force SureForms affecting versions prior to 2.13.0. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5.3 and is fixed in version 2.13.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.

CVE-2026-115610 is a stored cross-site scripting (XSS) vulnerability in PublishPress Authors plugin versions prior to 4.18.0. The flaw arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability affects versions from initial releases up to 4.17.0 and has been fixed in version 4.18.0.

Cisco has open sourced Project Quarry, a neurosymbolic rule language designed to detect AI agent attacks that manifest only across sequences of individually benign actions. Traditional security controls often fail to detect such attacks because they evaluate actions in isolation rather than as connected sequences. Quarry combines machine learning classifiers and rule-based checks to identify suspicious patterns in AI agent behavior over time. It supports runtime guardrails, post-hoc analytics, and incident response, integrating with Cisco's AI Security & Safety Framework. The project aims to become a shared standard for detecting AI-agent threats and to enable defenders worldwide to rapidly develop and share detection rules, countering attackers' use of AI to create sophisticated multi-step attacks.

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.

Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.