CVE-2026-114187 is a missing authorization vulnerability in the WPVibes AnyWhere Elementor plugin, affecting versions from initial release up to 1.3.0. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.3.1.
CVE-2026-121262 is a medium severity vulnerability in phpMyAdmin SQL-Parser versions 6.0.0 and 6.0.1. It involves incorrect type conversion in the parse function of src/Statements/ExplainStatement.php, triggered by manipulation of the nextToken argument. The vulnerability is remotely exploitable without authentication. Public exploit code exists, but no vendor response or patch has been provided.
CVE-2026-103077 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 4.0.3.
Microsoft has been recognized as a Leader in the 2026 Gartner Magic Quadrant for AI Agent Management Platforms, reflecting its approach to managing, securing, and scaling AI agents through Microsoft Agent 365. Agent 365 assigns unique identities to agents, integrates with existing Microsoft security and management tools, and supports a broad ecosystem of agents from various platforms. The platform enhances visibility, governance, and security of AI agents, including automated actions to manage risks. This announcement is a product and service recognition rather than a security threat or vulnerability.
CVE-2026-114185 is a stored cross-site scripting (XSS) vulnerability in WPVibes AnyWhere Elementor plugin versions prior to 1.3.1. It allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The issue is fixed in version 1.3.1.
CVE-2026-119485 is a Missing Authorization vulnerability in the weDevs Dokan plugin affecting versions from initial releases up to 5.3.2. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 5.3.3.
CVE-2026-39777 is a missing authorization vulnerability in the WC Lovers WCFM Membership plugin (wc-multivendor-membership) affecting versions from initial through 2.12.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 2.12.1.
CVE-2026-119487 is a missing authorization vulnerability in weDevs Dokan plugin versions before 5.3.3. This flaw allows unauthorized access due to incorrectly configured access control security levels. The issue affects Dokan versions from initial releases up to 5.3.2. A fix is available in version 5.3.3.
CVE-2026-120843 is a stored cross-site scripting (XSS) vulnerability in Barn2 Plugins' Posts Table with Search & Sort plugin. It affects versions from initial releases up to 1.4.14. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 1.4.15.
CVE-2026-114183 is a vulnerability in WPVibes AnyWhere Elementor plugin versions prior to 1.3.1 that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. The flaw affects versions from initial releases up to 1.3.0 and has a medium severity rating with a CVSS score of 6.5. A fix is available in version 1.3.1.
A vulnerability in Netfoil versions 0.3.0 up to but not including 0.6.1 causes the TTL (Time To Live) value not to be decremented. This results in stale records continuing to be served beyond their intended lifetime.
CVE-2026-116859 is a missing authorization vulnerability in the WPMU DEV Forminator plugin affecting versions prior to 1.58.4. This flaw allows attackers to exploit incorrectly configured access control, potentially leading to unauthorized modification of data. The issue is fixed in version 1.58.4.
CVE-2026-116858 is a medium severity vulnerability in WPMU DEV Forminator plugin versions before 1.58.4. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects Forminator versions from the initial release up to 1.58.3 and was fixed in version 1.58.4.
CVE-2026-39743 is a missing authorization vulnerability in WC Lovers WCFM Membership plugin versions prior to 2.12.1. The flaw allows attackers to exploit incorrectly configured access control, potentially leading to unauthorized actions. The issue was fixed in version 2.12.1.
CVE-2026-120846 is a missing authorization vulnerability in Uncanny Owl's Uncanny Automator plugin affecting versions prior to 8.0.0. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modifications. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 8.0.0.
Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.
Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.