CVE-2026-120194 is a vulnerability in json-glib's JSONPath slice evaluator used by json_path_query() that can cause an infinite loop when processing a slice expression with a negative step. This flaw allows an attacker who can supply crafted JSONPath expressions to cause the application to hang, resulting in a denial of service. There is no impact on confidentiality or integrity. No fixed release is currently available, and all shipped Red Hat and Fedora json-glib builds with this evaluator are affected. Mitigation involves avoiding evaluation of untrusted JSONPath expressions and rejecting slice expressions with negative steps until a fix is released.
CVE-2026-118599 is a file overwrite vulnerability in GNOME Epiphany affecting versions 47.0 and later. The vulnerability arises when installing WebExtension packages from .xpi files, which can be crafted as TAR archives containing hard links. This allows an attacker to overwrite existing user-writable files without warning during installation or opening of the malicious .xpi. The issue requires user interaction and does not affect confidentiality or availability directly. A fix is available that restricts support to ZIP format only.
A logic error in GNOME Epiphany's site permission handling causes camera and microphone access to be granted when the user only approves clipboard or website data access permissions. This flaw allows a malicious site that obtains clipboard or storage access approval to use getUserMedia without additional prompts, exposing audiovisual confidentiality. The vulnerability affects Epiphany versions 45.0 through at least 51.x and requires user interaction to approve a clipboard or website-data-access prompt. A fix has been implemented in the upstream repository.
The WooCommerce Extra Product Options Pro plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 3.3.2. This flaw arises from insufficient input sanitization and output escaping of the '<fieldname>_start' and '<fieldname>_end' parameters on product pages that have a Date & Time Range Picker extra field configured. An unauthenticated attacker can exploit this vulnerability by tricking a user into clicking a crafted link, causing arbitrary scripts to execute in the user's browser. The required field names are visible in the product page source, making exploitation easier without prior knowledge.
The Germanized for WooCommerce WordPress plugin up to version 4.1.4 has a vulnerability allowing unauthorized access to private customer data via activation token reuse. This occurs when the 'Disable login for unactivated customers' setting is set to No (non-default) and double opt-in is enabled. An authenticated attacker with Subscriber-level access can change their account email to a victim's billing email and redeem their original activation token, causing guest orders to be linked to the attacker's account and exposing sensitive billing information. Exploitation requires public customer registration and token redemption within one day.
The FlexStock – Product Stock Sync with Google Sheets for WooCommerce WordPress plugin versions up to 3.17.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'products[].post_content' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability is exacerbated by the exposure of a REST bearer token in the Dashboard page source without proper capability checks, allowing exploitation without higher privileges.
The Debug Log Manager plugin for WordPress (up to version 2.5.2) contains a stored cross-site scripting (XSS) vulnerability via the 'message' and 'pageUrl' parameters. This flaw allows unauthenticated attackers to inject malicious scripts that execute when a user accesses an affected page. Exploitation requires that debug logging with JavaScript error logging is enabled and that the attacker can obtain a publicly emitted nonce to bypass security checks.
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 is vulnerable to a reflected DOM-based cross-site scripting (XSS) flaw. This vulnerability arises from insufficient input sanitization and output escaping of a 'querystring:<key>' URL parameter, allowing unauthenticated attackers to inject arbitrary scripts. The attack exploits the server's resolution of the {field:*} placeholder, causing the client-side code to reconstruct field content from unsanitized query parameters, potentially executing malicious scripts when a user clicks a crafted link.
WP Directory Kit plugin for WordPress versions up to and including 1.6.0 is vulnerable to an SQL Injection via the 'idfield' parameter. This vulnerability allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of proper query preparation, potentially exposing sensitive database information.
The BuddyBoss Platform WordPress plugin up to version 3.6.0 is vulnerable to stored Cross-Site Scripting (XSS) via the Group Name field. Authenticated users with subscriber-level access or higher can inject malicious scripts if the setting allowing all members to create social groups is enabled, which is the default configuration. This vulnerability arises from insufficient input sanitization and output escaping.
The NextGEN Gallery plugin for WordPress (versions up to 4.4.1) contains a vulnerability that allows authenticated users with custom-level access or higher to execute remote code on the server. This occurs due to unrestricted file upload and unsafe handling of metadata in the render_image function, combined with a bypassable signature check. Attackers must own at least one gallery, a condition retained indefinitely even if permissions are later revoked.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images' parameter affecting all versions up to 2.8.197. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the browsers of administrators or editors when they access the pending listing's edit screen. This vulnerability enables a privilege escalation chain through normal editorial workflows.
CVE-2026-117681 is a vulnerability in konflux-ci where the user interface proxy disables TLS certificate verification for internal backend service connections in environments without a default service certificate authority. This allows an adjacent network attacker who can intercept traffic to capture a cluster-scoped authentication token with user impersonation rights, potentially leading to full administrative control of the cluster. The issue primarily affects non-OpenShift Kubernetes clusters where the service CA is not present by default.
CVE-2026-116964 is a high-severity vulnerability in konflux-ci that allows an attacker with repository write access to execute arbitrary code within the CI/CD workflow environment. The flaw arises from the injection of shell commands into environment export scripts, causing manifest synchronization scripts to evaluate unvalidated script output. Exploitation can lead to compromise of CI/CD pipelines, theft of authentication tokens and deployment credentials, and unauthorized access to production systems. Mitigation currently relies solely on user review of pull requests or merge requests, with no official patch or fix available.
CVE-2026-116086 is a code injection vulnerability in konflux-ci where an attacker with permission to trigger automated workflows can inject malicious filter commands via crafted issue titles. This leads to information disclosure of sensitive data such as API credentials, deployment keys, and internal notes in workflow logs. The vulnerability affects specific versions of konflux-ci and does not allow direct OS code execution or cluster compromise.
A vulnerability in konflux-ci causes sensitive GitHub access tokens to be stored in plaintext on CI runners without cleanup after execution. This allows a local attacker with access to the CI environment to read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution on the runner, limiting remote exploitation. No effective mitigation is currently available according to the vendor advisory.
The Newsletters plugin for WordPress up to version 4.18.1 contains a time-based SQL Injection vulnerability in the 'id' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and validation. Attackers can obtain necessary authentication tokens by subscribing through the public form and exploiting weak ownership checks, potentially extracting sensitive database information.
FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored Cross-Site Scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization is insufficient, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users access the injected pages.
The WP Activity Log plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.6.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Acadlix LMS plugin for WordPress versions up to and including 1.1.9 contains a path traversal vulnerability in the post_delete_assessment_file_by_id function. This flaw allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server due to insufficient file path validation. The vulnerability is exacerbated by weak permission checks relying on a publicly exposed nonce, effectively allowing unauthenticated exploitation. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php.