CVE-2026-124274 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. It allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to integrity impact without confidentiality or availability loss. The issue is fixed in version 4.0.3.
CVE-2026-122675 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wpmet Wp Social plugin affecting versions prior to 3.2.4. This flaw allows an attacker to trick authenticated users into performing unwanted actions on the site. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 3.2.4.
CVE-2026-121761 is a missing authorization vulnerability in Infomaniak Network's VOD Infomaniak product. It allows exploitation due to incorrectly configured access control security levels. The issue affects versions from initial releases up to 1.5.15 and is fixed in version 1.5.16. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-121767 is a missing authorization vulnerability in the weDevs weDocs plugin affecting versions prior to 2.6.2. It allows unauthorized access due to incorrectly configured access control security levels. The issue is fixed in version 2.6.2.
CVE-2026-121778 is a missing authorization vulnerability in WP Lab's WP-Lister Lite for Amazon plugin, affecting versions prior to 2.9.2.5. The flaw allows exploitation of incorrectly configured access control, potentially enabling unauthorized access to certain plugin functionalities. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 2.9.2.5.
CVE-2026-121779 is a vulnerability in YITH WooCommerce Subscription versions prior to 4.23.0 that allows unauthorized parties to retrieve embedded sensitive system information. This exposure could potentially aid attackers in further reconnaissance but does not directly impact system integrity or availability.
CVE-2026-39733 is a Cross-Site Scripting (XSS) vulnerability in the ProfilePress plugin for WordPress, specifically in the wp-user-avatar component. It allows improper neutralization of script-related HTML tags, leading to potential code injection. This affects ProfilePress versions from initial releases up to 4.17.7. The vulnerability has a medium severity score of 5.3 and is fixed in version 4.18.0.
The genblaze-atlascloud package on PyPI version 0.1.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The genblaze-fal package on PyPI version 0.1.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The Advanced Form Integration — Connect Forms to 300+ Apps WordPress plugin up to version 2.10.2 is vulnerable to PHP Object Injection via deserialization of untrusted input. Exploitation requires an administrator to have configured at least one active NexForms integration. No direct impact occurs unless another plugin or theme with a PHP Object Injection POP chain is present, which could then enable actions like arbitrary file deletion, data retrieval, or code execution. The vulnerability affects versions up to and including 2.10.2 and has a high severity CVSS score of 8.1.
The dsh-notify-focus npm package contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software installed as a result. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.
CVE-2026-123957 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setIpQosRules function within the /cgi-bin/cstecgi.cgi file, where manipulation of the ipStart argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed, increasing the risk of exploitation.
The pulumi-doppler package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
CVE-2026-123881 is a medium severity vulnerability in OpenBMB Internet of Agents affecting the fetch_chat_record function in the Message Handler component. Improper access controls on the comm_id argument allow remote attackers to potentially access unauthorized chat records. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not yet responded or issued a fix.
The aBlocks WordPress plugin up to version 2.18.0 contains a stored cross-site scripting (XSS) vulnerability via the 'headingTag' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress versions up to and including 3.3.8 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of certain parameters, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages.
The Strong Testimonials WordPress plugin up to version 3.3.16 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'star_rating' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator previews a pending testimonial, a step common in the plugin's moderation process.
The aBlocks – Gutenberg Blocks plugin for WordPress up to version 2.18.0 contains a vulnerability that allows authenticated users with contributor-level access or higher to expose the full rendered content of any password-protected post by using a shortcode with the post's ID. Users with author-level access or higher can publish posts embedding this shortcode, which exposes the protected content to unauthenticated visitors.
The GamiPress – Gamification plugin for WordPress, including its AI integration, is vulnerable to an SQL Injection flaw in all versions up to and including 8.1.1. This vulnerability arises from insufficient escaping of the 'input_<field_id>.<part>' parameter used in Gravity Forms integration, allowing authenticated users with subscriber-level access or higher to inject additional SQL queries. Exploitation requires a configured GamiPress achievement tied to a Gravity Forms field value submission event with the form published, which is a common setup for sites using this integration.
The WebToffee WP Backup and Migration WordPress plugin up to version 1.6.1 contains a SQL Injection vulnerability via the 'description' parameter. Authenticated users with subscriber-level access or higher can inject SQL code due to insufficient input escaping. Exploitation requires an administrator to perform a local database export and restore operation, which is the plugin's primary function, to trigger the vulnerability. This vulnerability can lead to unauthorized disclosure of sensitive database information. The CVSS score is 5.7, indicating a medium severity risk.