The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.
The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.
The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.
Multiple vulnerabilities have been identified in SS1 and SS1 Cloud products by DOS Co., Ltd., as well as in the ODM product rocoeyes by Rococo Co. Ltd. Specific details about the vulnerabilities, their impact, or affected versions have not been disclosed.
CVE-2026-124571 is a SQL injection vulnerability in SourceCodester Simple CRUD using PHP and FPDF version 1.0. The flaw exists in the app/register.php file where manipulation of the 'firstname' argument allows remote attackers to perform SQL injection. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. Exploit code has been published, but there is no indication of active exploitation in the wild. No patch or remediation information is currently available.
CVE-2026-124570 is a cross-site scripting (XSS) vulnerability in SourceCodester Online Leave Management System version 1.0. The flaw exists in the Employee Avatar Upload Extension within the app/classes/Master.php file, where manipulation of the employee avatar filename parameter allows injection of malicious scripts. This vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 score is 4.8, indicating medium severity.
Multiple integer overflow vulnerabilities have been identified in the Ruby 4.0 regular expression compiler, including one affecting CI/CD pipelines. These issues could lead to unexpected behavior or potential security risks when processing regular expressions. Red Hat has released an update for Ruby 4.0 in Red Hat Enterprise Linux 9 to address these vulnerabilities along with other bug fixes and enhancements.
CVE-2026-124569 is a medium severity vulnerability in the fushengqian fuintCatering product affecting the updateCommissionCash function in CommissionCashServiceImpl.java. The flaw involves improper access controls due to manipulation of the Status argument, allowing remote attackers to exploit it. The product uses rolling releases, so specific affected and fixed versions are not available. The vendor has not responded to the disclosure, and no patch information is provided.
CVE-2026-124568 is a medium severity vulnerability in the fushengqian fuintCatering product affecting the RefundServiceImpl.agreeRefund function. It involves improper access controls that can be exploited remotely without user interaction. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently provided.
Multiple vulnerabilities have been identified in WebSAM WinShare, a product by NEC Corporation. No specific details about the nature or impact of these vulnerabilities are provided.
Multiple security vulnerabilities have been identified in the glibc packages used by Red Hat Enterprise Linux 8. These include a stack overflow in nscd causing degraded DNS resolution, a denial of service via long search domain in the DNS stub resolver, a TOCTOU race condition in the dynamic loader leading to privilege escalation and arbitrary code execution, and a stack-based buffer overflow causing denial of service and information disclosure. These issues affect critical system libraries essential for Linux system functionality.
CVE-2026-124567 is a medium severity vulnerability in the fushengqian fuint product affecting the receipt function in ClientOrderController.java. It allows remote attackers with low privileges to manipulate the system state. The product uses a rolling release model, so specific affected or fixed versions are not disclosed. The vendor has not responded to disclosure attempts, and no patch information is available.
Multiple security vulnerabilities have been identified in Ruby 3.3, including a double free issue in the regular expression parser and several integer overflow issues in the regular expression compiler. These vulnerabilities have been addressed in a security update released by Red Hat for Red Hat Enterprise Linux 9. The update rebases Ruby 3.3 to the latest upstream release, incorporating these security fixes along with bug fixes and enhancements.
A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability (CVE-2026-92392) affecting the curl utility and libcurl library in Red Hat Enterprise Linux 10 has been addressed. The flaw is a Use-After-Free issue related to HTTP/2 upload functionality. Red Hat has released an important security update fixing this vulnerability in curl packages for multiple architectures. Users of affected Red Hat Enterprise Linux 10 versions are advised to apply the update as detailed in the Red Hat advisory.
CVE-2026-124565 is a medium severity vulnerability in the fushengqian fuint product affecting the confirm function in MerchantOrderController.java related to order verification. It allows remote attackers to bypass access controls due to improper implementation. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor did not respond to early disclosure attempts, and no patch information is currently available.
CVE-2026-113364 is a critical heap-based buffer overflow vulnerability in NEC Corporation WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows. It allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges by sending a crafted packet containing a malformed data size value in the protocol header.