The Apache Struts 2 REST Plugin has a vulnerability where the @StrutsParameter authorization checks do not apply to members annotated with Jackson's @JsonAnySetter. This means that certain parameters may bypass intended authorization controls.
CVE-2026-42949 is an authorization bypass vulnerability in the /api/runscript endpoint of Frangoteam's FUXA product version 1.3.2-2809. This flaw allows an unauthenticated attacker to execute privileged operations by sending a specially crafted HTTP request. The vulnerability has a medium severity rating with a CVSS score of 5.6.
CVE-2026-40063 is an information disclosure vulnerability in the /nodered/fuxa/scripts functionality of Frangoteam's FUXA product version 1.3.2-2809. An unauthenticated attacker can send a specially crafted HTTP request to trigger this flaw and leak sensitive information.
CVE-2026-42922 is a critical authorization bypass vulnerability in the /nodered functionality of Frangoteam FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that can lead to arbitrary code execution on the affected system.
CVE-2026-118426 is a missing authorization vulnerability in Octopus Deploy Octopus Server when the LDAP authentication provider is enabled. Authenticated users can call LDAP user and group search functions without proper authorization. This issue affects specific versions prior to fixed releases 2026.2.13487 and 2026.3.15909. The vulnerability has a medium severity with a CVSS score of 5.3.
4NTL is a browser extension for Chromium-based browsers that enables quick threat intelligence lookups from the right-click menu. It allows users to check IPs, domains, URLs, or file hashes against VirusTotal and AbuseIPDB without leaving the current page. The extension is designed to improve analyst efficiency by reducing the need to copy and paste indicators into separate tabs. It respects user privacy by only querying VirusTotal and AbuseIPDB, never submitting new samples, and keeping API keys local to the browser profile. No active exploitation or vulnerabilities are reported in the extension itself.
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
CVE-2026-21157 is a high-severity vulnerability in Samsung Mobile's Bixby prior to version 4.0.85.6. It involves improper input validation that allows privileged local attackers to launch arbitrary activities on the device.
An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.
A weakness in nschloe meshio up to version 5.3.5 affects the VTK Reader component in the file meshio/_vtk_42.py. Manipulating the DIMENSIONS argument can cause uncontrolled memory allocation. The vulnerability can be exploited remotely and has a medium severity rating with a CVSS score of 5.3. The project has been informed but has not yet responded or issued a fix.
A security flaw in dfm feedfinder2 up to version 0.0.4 allows remote attackers to perform server-side request forgery (SSRF) via the find_feeds function in feedfinder2.py. This vulnerability enables an attacker to manipulate server requests, potentially accessing internal resources. The issue was reported to the project early, but no response or fix has been issued yet.