Threat database

CVE-2026-123966 is a critical heap-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the saveParentControlInfo function, specifically in the handling of the deviceId argument in the /goform/saveParentControlInfo endpoint. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, increasing the risk of exploitation.

CVE-2026-120984 is a critical vulnerability in the Red Hat Build of Keycloak server's client management component. It occurs when a client is created or imported with authorization services enabled, and the system fails to clear an internal session attribute properly. This flaw allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy. The malicious script executes on the server during authorization requests, potentially enabling arbitrary code execution and full system compromise. Exploitation requires elevated privileges and authenticated access. No official fix or mitigation is currently available from Red Hat.

CVE-2026-123860 is a medium severity vulnerability in Crocoblock JetFormBuilder up to version 3.6.8. It involves improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) vulnerability that allows code injection. The issue is fixed in version 3.6.8.1.

CVE-2026-123964 is a medium-severity vulnerability in OpenBMB Internet of Agents affecting the launch_goal function in the Collaboration Layer component. Manipulating the max_turns argument can cause an infinite loop, potentially leading to denial of service. The vulnerability can be exploited remotely. The project uses a rolling release model, so specific affected or fixed versions are not available. Public exploit code exists, but no vendor response or patch has been provided yet.

CVE-2026-123861 is an authorization bypass vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select versions prior to 1.0.11. The flaw allows attackers to exploit incorrectly configured access control security levels by manipulating a user-controlled key. This issue affects versions from initial release up to 1.0.10 and has been fixed in version 1.0.11.

CVE-2026-120839 is a high-severity vulnerability in Magepeople inc.'s WpTravelly tour-booking-manager plugin. It involves improper control of filenames used in include/require statements, leading to a PHP Local File Inclusion (LFI) flaw. This affects WpTravelly versions from initial releases up to 2.3.8. The vulnerability allows an attacker with low privileges to execute arbitrary code by including unintended local files. The issue is fixed in version 2.3.10.

CVE-2026-120841 is a high severity vulnerability in Magepeople inc.'s WpTravelly tour-booking-manager plugin. It involves improper control of filenames in include/require statements, leading to PHP Local File Inclusion. This flaw affects WpTravelly versions from initial releases up to 2.3.8. The vulnerability allows an attacker with low privileges to execute arbitrary code with high impact on confidentiality, integrity, and availability. A fix is available in version 2.3.10.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.

CVE-2026-123467 is a missing authorization vulnerability in StylemixThemes Motors plugin for WordPress, affecting versions before 1.4.129. It allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The vulnerability has a medium severity score of 4.3 and is fixed in version 1.4.129.

CVE-2026-122659 is a missing authorization vulnerability in WP ManageNinja LLC's Fluent Booking plugin affecting versions before 2.6.0. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure or modification. The issue is fixed in version 2.6.0.

CVE-2026-121579 is a stored cross-site scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) affecting versions before 2.0.28. The flaw involves improper neutralization of input during web page generation, which can lead to persistent injection of malicious scripts. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fixed version, 2.0.28, is available to address this issue.

CVE-2026-121575 is a missing authorization vulnerability in WP User Manager versions prior to 2.10.5. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-122660 is a missing authorization vulnerability in BAKKBONE Australia FloristPress versions prior to 7.8.6. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity. The issue has a medium severity rating with a CVSS score of 4.3. A fix is available in version 7.8.6.

CVE-2026-123483 is a medium severity vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8.1. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects versions from initial releases up to 3.6.8. The issue has been fixed in version 3.6.8.1.

CVE-2026-123183 is a Cross-Site Scripting (XSS) vulnerability in PluginUs.Net's Active Products Tables for WooCommerce plugin. The flaw allows improper neutralization of script-related HTML tags, enabling code injection. Versions from initial release through 2.1.6 are affected. The issue is fixed in version 2.1.7.

CVE-2026-123474 is a missing authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress. It affects versions from initial releases up to 2.3.18. The flaw allows unauthorized network attackers to exploit incorrectly configured access control, potentially leading to limited confidentiality impact. A fix is available in version 2.3.19.

CVE-2026-121775 is a missing authorization vulnerability in VillaTheme CURCY woo-multi-currency plugin versions before 2.2.21. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue has a medium severity rating and a CVSS score of 5.3.

CVE-2026-123462 is a missing authorization vulnerability in the myCred plugin affecting versions before 4.0.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue is fixed in version 4.0.3.

CVE-2026-122669 is a stored cross-site scripting (XSS) vulnerability in Everest Forms versions prior to 3.6.4. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of other users. The vulnerability is fixed in version 3.6.4.

CVE-2026-122663 is a missing authorization vulnerability in VillaTheme CURCY woo-multi-currency plugin versions before 2.2.21. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 2.2.21.