CVE-2026-85347 is a cross-site scripting (XSS) vulnerability in the FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212. The plugin fails to properly sanitize and escape user-supplied input, allowing users with Contributor role or higher to inject arbitrary scripts. These scripts execute when a higher-privileged user views the affected page, potentially leading to unauthorized actions or data exposure.
The FV Flowplayer Video Player WordPress plugin before version 7.5.56.7212 contains a missing authorization vulnerability in its cloud storage media browser handlers. This flaw allows any authenticated user, even with minimal permissions such as Subscriber, to access configuration details and file listings of the site's connected cloud storage accounts without proper authorization or CSRF checks.
The All In One Login WordPress plugin versions 2.4.0 up to but not including 2.5.0 contain an improper privilege management vulnerability. This flaw allows unauthenticated attackers to bypass brute-force protections on the short numeric code used by the plugin's default passwordless email login feature, potentially enabling account takeover including administrator accounts. The issue is fixed in version 2.5.0.
WP Event Manager plugin versions before 3.4.2 contain an authorization bypass vulnerability that allows users with Subscriber accounts or higher to reassign authorship of arbitrary posts to themselves and publish them. This can lead to unauthorized content takeover and public disclosure of private or draft content if the relevant frontend feature is enabled.
CVE-2026-123014 is an argument injection vulnerability in iTerm2 versions before 3.7.7beta2. It affects the x-man-page URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by tricking the user into opening a crafted URL. The vulnerability arises because percent-encoded NUL characters bypass input sanitization and are converted to whitespace during command-line parsing, enabling injection of additional arguments to the /usr/bin/man command. This includes injecting the -P option to specify an attacker-controlled pager command. The issue is due to an incomplete fix for a previous vulnerability (CVE-2023-46321).
The synapse-hub npm package version 3.1.0 contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an external attacker. Immediate removal of the package and rotation of all secrets and keys stored on the affected system are strongly advised, although removal may not fully eliminate the threat due to possible persistent malicious software.
SHIRASAGI Project's SHIRASAGI software contains multiple unspecified vulnerabilities. No detailed information about the nature, impact, or affected versions of these vulnerabilities is provided.
CVE-2026-123012 is a vulnerability in Gogs version 0.14.3 where the Git Smart HTTP authorization layer improperly handles case sensitivity when checking verbs. This flaw allows a user with only read access to perform a push operation, which should be restricted. The issue arises due to inconsistent case-sensitive checks in the authorization logic.
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the `manage_give_settings` capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types 'spinner', 'slider', 'color', and 'date' receive per-type value validation that would block the entity-encoded payload.
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post sanitization applied at save time operates only on array leaf values, leaving array keys entirely unsanitized; the injected key is then rendered directly into an id="filelist-<KEY>" HTML attribute without esc_attr() in Redux_Multi_Media::render(), allowing attribute breakout.
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or plugin PHP files, cannot be reached.
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several White House staffers are using devices with residential proxy services that allow others to rent their internet addresses, including a Russian proxy service linked to past election cyberattacks. Security firms detected persistent proxy activity originating from the White House network (AS2650) involving multiple proxy providers, enabling public access to these IP addresses. Residential proxy services can anonymize traffic but also pose security risks, including facilitating malicious activities and exposing local networks to malware. These proxies often come from employee devices and have been found widely in government and corporate networks. Vulnerabilities in such services have been exploited to gain control over devices within local networks. This situation highlights significant security concerns for trusted government networks.
A vulnerability in STMicroelectronics st-mems-android-linux-sensors-hal before commit 7bdf334 allows improper validation of the specified quantity of input channels. The software does not verify whether the allowed number of channels is exceeded, potentially leading to limited impact on integrity and availability.
The twilio-labs netlify-okta-auth package up to version 1.0.2 has a vulnerability where it relies on an unverified 'iss' claim. This affects outbound HTTP requests used to retrieve a public signing key and may cause additional issues if the oktaUrl configuration is missing or incorrect. The vulnerability is classified under CWE-669, indicating incorrect resource transfer between security spheres.
A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.
The PyPI package 'rcp-ndcg' version 9999.0.0 has been identified as malicious by the OpenSSF Package Analysis project. It is flagged due to its communication with a domain associated with malicious activity. No further technical details or CVSS score are provided.