Threat database

CVE-2026-121263 is a path traversal vulnerability in the phpMyAdmin MoTranslator component affecting versions 6.0.0 and 6.0.1. The flaw exists in the Loader::getTranslator function, where manipulation of the locale argument can lead to unauthorized file path access. The vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.

CVE-2026-121628 is a race condition vulnerability in Bagisto versions before 2.3.16 and 2.4.1 that allows attackers to redeem single-use coupons multiple times by submitting concurrent order requests. This flaw exists in the manageCartRule() function and affects the onepage orders checkout endpoint, bypassing usage checks on coupons.

Buku versions 5.0 through 5.1.1 contain a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL, which can be submitted through the unauthenticated /api/bookmarks endpoint. Exploitation enables attackers to execute scripts in the context of the victim's browser, potentially issuing same-origin API requests with the victim's credentials.

GNU Gatekeeper (gnugk) versions before 5.16 have an out-of-bounds read vulnerability in the H46024Socket::ReceivedProbePacket() function. This flaw allows remote attackers to cause a heap over-read by sending short probe packets, specifically short application-defined RTCP packets during H.460.24 probing. Exploitation may lead to reading beyond allocated heap memory and potentially crashing the gatekeeper.

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

Nanosystems Supremo versions before 5.0.2.3874 for Windows and macOS have an improper certificate validation vulnerability. This flaw allows attackers on the same network to intercept TLS connections by using self-signed certificates. Exploitation can lead to exposure of usernames, SHA-256 password hashes, and license codes. The vulnerability is fixed in version 5.0.2.3874.

Lightdash versions from 0.2609.0 up to but not including 3.137.0 have an authorization bypass vulnerability in the RenameService. Authenticated users with update Project permission on one project can access and modify dashboards of other projects due to improper verification of project identifiers. This allows attackers to modify dashboard filters and break charts or read field metadata from unauthorized projects. The vulnerability is fixed in version 3.137.0.

CVE-2026-119509 is a missing authorization vulnerability in the eranfl ClickCease Click Fraud Protection plugin affecting versions prior to 3.3.1. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5.3 and was fixed in version 3.3.1.

CVE-2026-97072 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 4.0.3.

CVE-2026-114187 is a missing authorization vulnerability in the WPVibes AnyWhere Elementor plugin, affecting versions from initial release up to 1.3.0. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.3.1.

A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.

CVE-2026-114183 is a vulnerability in WPVibes AnyWhere Elementor plugin versions prior to 1.3.1 that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. The flaw affects versions from initial releases up to 1.3.0 and has a medium severity rating with a CVSS score of 6.5. A fix is available in version 1.3.1.

A vulnerability in Netfoil versions 0.3.0 up to but not including 0.6.1 causes the TTL (Time To Live) value not to be decremented. This results in stale records continuing to be served beyond their intended lifetime.

CVE-2026-116859 is a missing authorization vulnerability in the WPMU DEV Forminator plugin affecting versions prior to 1.58.4. This flaw allows attackers to exploit incorrectly configured access control, potentially leading to unauthorized modification of data. The issue is fixed in version 1.58.4.