CVE-2026-124588 is a code injection vulnerability in huggingface finetrainers versions 0.1.0 and 0.2.0. The flaw exists in the resolve_component_cls function within finetrainers/utils/model.py, specifically in the Model Index Handler component. An attacker can remotely manipulate the Library argument to inject code. Public exploit code is available, but the vendor has not yet responded or issued a patch.
Apache Airflow versions from 3.0.5 up to but not including 3.4.0 contain an OS command injection vulnerability in the example_dag_decorator example DAG. This occurs because the DAG validates an IP address fetched over HTTP using Python's ipaddress module, which accepts IPv6 zone identifiers with arbitrary characters. These characters can be injected into shell commands executed on the worker, allowing command injection. This vulnerability is an incomplete fix of a previous issue (CVE-2025-54941). Users should upgrade to version 3.4.0 or later or disable example DAGs in production.
CVE-2026-92683 is a high-severity authorization vulnerability in the @neo4j/graphql library versions 7.0.0 through before 7.6.7. It involves incorrect authorization logic in the @authentication directive's JWT filter evaluation, allowing an attacker with a valid JWT to bypass all but the first filter condition when using multi-condition JWT where filters. This flaw is fixed in version 7.6.7.
A Missing Authorization vulnerability (CVE-2026-94249) exists in TÜBİTAK BİLGEM Software Technologies Research Institute's Liderahenk software before version 2.0.3. This flaw allows privilege abuse by users with some level of privilege, potentially leading to unauthorized high-impact actions. The vulnerability has a high severity score of 8.1 (CVSS 3.1) with network attack vector, low attack complexity, and no user interaction required.
A critical OS command injection vulnerability exists in the add_expmac function of the Web Administration Interface component in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This vulnerability allows remote attackers with low privileges to execute arbitrary operating system commands by manipulating the 'mac' argument. Public exploit code is available, and the vendor has not responded to disclosure attempts.
A vulnerability in wummel patool version 4.1.0 affects the extract_gzip function in the Gzip Extraction Handler component. The flaw allows symlink following due to improper handling, requiring local access to exploit. This can lead to limited integrity and availability impacts. The vulnerability has a medium severity score of 4.4 and no known exploits in the wild.
A path traversal vulnerability exists in WebTorrent versions up to 2.8.5 and 3.0.21 in the getFileModtimes function of the torrent.js file. This vulnerability allows remote attackers to manipulate the file.path argument, potentially accessing unauthorized file system locations. The issue is publicly known and exploit code is available, but the maintainers have closed the related GitHub issue as "not planned" for a fix.
CVE-2026-124581 is a SQL injection vulnerability in itsourcecode Airline Reservation System 1.0 affecting an unknown function in /admin/manage_flight.php. The vulnerability allows remote attackers to manipulate the ID argument to execute unauthorized SQL commands. Public exploit code has been disclosed. The CVSS score is 7.3, indicating high severity.
A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer versions from 0.8.0 before 0.8.1. This flaw allows an attacker to leverage the race condition to cause integrity and availability impacts. The vulnerability has a medium severity with a CVSS score of 6. No patch or remediation information is currently provided.
CVE-2026-124579 is a high-severity vulnerability in aaPanel BillionMail up to version 4.9. It affects the Relay Configuration API component, specifically the file core/api/relay/v1/relay.go. The flaw involves injection via manipulation of the helo_name argument, which can be exploited remotely. Public exploit code has been disclosed, but the vendor has not responded or issued a fix.
CVE-2026-116337 is a low severity vulnerability in the Qt Framework's HTTP response handling within the Qt Network module that allows uncontrolled resource consumption. It was published on November 9, 2026. No affected versions or patches are specified. There are no known exploits in the wild.
A critical remote code execution vulnerability exists in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. The flaw is in the handle_wechat_cn_wifi function of the Weixin Auth Endpoint component, where improper handling of the 'extend' argument allows OS command injection. Exploit code has been publicly disclosed, but the vendor has not responded or issued a patch.
A security vulnerability exists in BeikeShop versions up to 2.0.0.31 affecting the OrderRepo::getOrderByNumber function in the Guest Order Lookup component. The flaw allows remote manipulation of the order_number argument, leading to enforcement of behavioral workflow, which may impact confidentiality, integrity, and availability. Upgrading to version 2.0.0.32 addresses this issue.
The Post Duplicator WordPress plugin versions prior to 3.0.18 contain a vulnerability where the plugin does not properly validate capabilities assigned to roles via its permissions settings. This flaw allows a site administrator on a multisite network, who is not a Super Admin, to grant arbitrary capabilities to any role, including network-management capabilities that should be restricted to Super Admins.
A vulnerability in the WP BASE Booking of Appointments, Services and Events WordPress plugin before version 6.5.1 allows authenticated users with Subscriber-level access or higher to create new administrator accounts, leading to privilege escalation.
The WP Duplicate WordPress plugin through version 1.1.11 contains a vulnerability where it fails to properly verify request authentication and does not validate the path or type of uploaded files. This flaw allows unauthenticated attackers to write arbitrary files to the server, potentially leading to remote code execution. The vulnerability is actively exploited in the wild.
A vulnerability in SiteServer SSCMS up to versions 7.1.3, 7.2.1, and 7.4.0 affects the LoginController.Submit function in the Admin-Login CAPTCHA component. The flaw involves improper restriction of excessive authentication attempts due to manipulation of the isForceLogoutAndLogin argument. This vulnerability can be exploited remotely but requires high attack complexity and is difficult to exploit. A patch identified by commit df3becb7ebb00a48435418a44fd08a459eb38ace is available to address the issue.
The UniPAY Payment Gateway for WooCommerce WordPress plugin versions before 2.4 lacks authorization checks when returning an order's order-received URL based on an attacker-supplied order ID. This vulnerability exposes the order's secret key in the redirect URL and allows unauthenticated attackers to enumerate orders and access customers' personal information including name, email address, phone number, and address.
The GemBooking WordPress plugin versions prior to 1.7.1 have a concurrency control flaw that allows unauthenticated users to create overlapping confirmed bookings for the same team member by sending simultaneous booking requests. This occurs because the plugin does not serialize concurrent booking requests per team member, potentially leading to booking conflicts.
The Event Tickets Manager for WooCommerce WordPress plugin versions before 1.6.0 has a vulnerability where it fails to validate ticket-type prices sent to an unauthenticated AJAX action if the referenced product has no ticket types configured. This flaw allows unauthenticated users to set arbitrary prices, including free, for event tickets site-wide, affecting all subsequent ticket purchases. The issue stems from an incomplete fix of a previous vulnerability (CVE-2026-34898).