A vulnerability in Logseq versions 2.0.1 and 2.0.2 affects the validate-auth-token function in the Local HTTP API component, resulting in missing authentication. This flaw can be exploited remotely without privileges or user interaction. Public exploit code exists, but the vendor has not yet responded or issued a fix.
A critical authentication weakness exists in Intelbras SG 2404 PoE L2+ versions 1.00.70 and 1.00.72 in the Web Management Interface component. This flaw allows remote attackers to bypass authentication via manipulation of an unknown function in the /EXCU_SHELL file. Public exploit code is available. Upgrading to version 1.00.74 resolves the issue.
An insecure storage vulnerability exists in the SS1 product by DOS Co., Ltd., allowing sensitive information used by the product to potentially be obtained by unauthorized parties. The issue does not impact integrity or availability but may lead to confidentiality loss.
The Fusion Page Builder WordPress plugin versions prior to 1.7.1 contain a vulnerability where the plugin does not verify ownership of content before moving it to the trash. This flaw allows users with Contributor-level roles to trash arbitrary posts and pages or permanently delete them if the trash feature is disabled.
The Mail Debug for WooCommerce WordPress plugin up to version 1.3.0 lacks proper capability, authentication, and nonce checks on an email-logging action. This flaw allows unauthenticated users to access the full body of all emails sent by the site, including sensitive password-reset emails. Exploiting this vulnerability could enable an attacker to obtain reset keys and take over administrator accounts.
The Post Duplicator WordPress plugin versions before 3.0.18 contain a vulnerability that allows a site administrator on a multisite network, who is not a Super Admin, to overwrite arbitrary site options. This includes the ability to modify role definitions, potentially granting themselves network-management capabilities.
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API plugin up to version 2.0 improperly handles administrator credentials by failing to prevent their disclosure to unauthenticated users and not correctly verifying authentication. This vulnerability allows unauthenticated attackers to obtain administrator credentials and gain full administrator access to the affected WordPress site.
The Limit Login Attempts Security WordPress plugin versions before 3.4.1 contains a vulnerability where the two-factor authentication (2FA) step is not properly confirmed before completing a login. This flaw allows an attacker who knows a user's password to bypass the second factor by sending a specially crafted request header that disrupts the 2FA process.
The Grand Job WordPress plugin versions up to 1.2.1 contain a vulnerability where the password reset code is not properly verified before allowing a password update. This flaw enables unauthenticated attackers to reset passwords for arbitrary accounts, including administrator accounts, potentially leading to full site takeover.
The All-in-One Video Gallery WordPress plugin versions before 5.1.1 do not verify if a video is password protected before serving it via its standalone player page and download link. This flaw allows unauthenticated users to access the media sources of videos that are intended to be password protected, including unlisted YouTube or Vimeo links and external file URLs.
The Limit Login Attempts Security WordPress plugin versions before 3.4.1 have a vulnerability where two-factor authentication (2FA) is not enforced on all password-authentication routes. This allows an attacker who already knows a user's password to bypass the second factor by authenticating through an alternative login interface, gaining access without completing 2FA.
The mView 豆瓣电影 WordPress plugin up to version 1.0.3 allows any authenticated user, including subscribers, to upload arbitrary PHP files without validating the file type, name, or source. This lack of validation and authorization checks enables remote code execution by saving malicious files to a web-accessible directory.
The AZEXO Store Locator WordPress plugin versions through 1.4 contain a vulnerability where AJAX actions lack capability and nonce checks and fail to sanitize a request header used in file path construction. This flaw allows any authenticated user, including low-privileged roles like subscribers, to write files with arbitrary names, locations, and content, potentially leading to remote code execution.
CVE-2026-124587 is an information disclosure vulnerability in elizaOS eliza version 2.0.3-beta.7. It affects an unknown function within the HTTP Server component, specifically in the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts. The vulnerability can be exploited remotely and exploit code is publicly available. A patch identified by commit cf6fa193017e70884e01c5bb7890f74b6b2b79d2 has been released to address this issue.
Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.
Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. Users are advised to upgrade to apache-airflow 3.4.0 or later.
CVE-2026-124637 is a stored Cross-Site Scripting (XSS) vulnerability in Kompini Tankuam Places affecting the profile editing form parameters cliNom and cliCognoms. User input is not validated or escaped before being stored and displayed, enabling execution of arbitrary JavaScript in users' browsers. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. No affected versions or patches are specified. There are no known exploits in the wild.
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later.
CVE-2026-124586 is an out-of-bounds read vulnerability in Tencent RapidJSON version 1.1.0. The flaw exists in the GetCachedPowerByIndex function within the library's internal diyfp.h file. Manipulating the decimalPosition argument can trigger this vulnerability. The issue can be exploited remotely, and public exploit code has been disclosed. The vendor has been notified but has not yet responded or issued a fix.