Zoho Corporation's ManageEngine ADAudit Plus versions prior to 8703 contain an authenticated SQL injection vulnerability in the Reports API. This flaw allows an attacker with valid credentials to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is tracked as CVE-2026-12062 and has a high severity rating with a CVSS score of 8.8. A fix is available in version 8703.
The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.
The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.
The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.
The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request.
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.
Zoho Corporation's ManageEngine ADAudit Plus versions prior to 8711 contain an authenticated second order SQL injection vulnerability in the custom reports module. This vulnerability allows an attacker with valid credentials to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The issue is fixed in version 8711.
CVE-2026-105948 is a high-severity vulnerability in Octopus Server affecting certain versions that use LDAP authentication with self-service login editing enabled. The flaw involves incorrect authorization validation, allowing users to edit their own login identities and potentially escalate their privileges up to system administrator level. This issue is fixed in versions 2026.2.13487 and 2026.3.15909.
The ARForms WordPress plugin up to version 7.2.4 contains an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload malicious files, including executable PHP code, by exploiting insufficient validation of file names and types in the form file-upload handler. Successful exploitation requires a publicly accessible form with a File field. This vulnerability can lead to remote code execution on the affected server.
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is deserialized via maybe_unserialize() when an administrator views the affected entry; if the attacker's array contains a 'referrer' key, the attacker-controlled page_url and http_referrer values are used as-is and rendered unescaped into the admin entry detail view.
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication required at any step.
The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text.
CVE-2026-93487 is a high-severity vulnerability in Octopus Server where incorrect authorization validation allows users with certain permissions to create project triggers that enable them to run runbooks or create deployments without proper authorization. This flaw affects specific versions of Octopus Server prior to fixed releases 2026.2.13487 and 2026.3.15863.
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.
Apple released security updates across multiple platforms to address 10 vulnerabilities, including Bluetooth and AirPlay pairing flaws, iMessage group chat issues, and an exploited Brotli bug. Several Bluetooth and AirPlay flaws allow attackers within Bluetooth range or on the same network to bypass pairing code limits or pair without user interaction. Two iMessage vulnerabilities could allow unauthorized access to group chats or earlier conversations. The updates cover iOS, iPadOS, macOS, watchOS, and visionOS with specific fixes for certain devices. No exploitation in the wild has been reported for these Apple-specific vulnerabilities.
Red Hat has issued a security advisory for the gcc compiler packages addressing two vulnerabilities: an integer wrap in the std library (CVE-2026-114691) and a confirmed out-of-bounds read/write in the libstdc++ parallel std library (CVE-2026-114690). These issues affect multiple architectures of Red Hat Enterprise Linux 8 and related products. The update is rated as having a moderate security impact. No CVSS score is provided in the advisory, and no known exploits are reported in the wild.
The YITH WooCommerce Gift Cards WordPress plugin through version 4.39.0 has a vulnerability where it issues gift cards credited with the item's pre-discount price rather than the amount actually paid. This allows customers to combine store coupons with gift card purchases to obtain gift cards worth more than their payment.
The Security For WooCommerce WordPress plugin versions through 1.0.16 have a vulnerability where one of its REST API routes is not access-restricted. This allows unauthenticated users to retrieve detailed reports about the server, PHP, WordPress configuration, installed plugin versions, and the site administrator's email address.
The Security For WooCommerce WordPress plugin up to version 1.0.16 has a vulnerability where one of its REST API routes is accessible without authentication. This flaw allows unauthenticated users to retrieve the email addresses of all administrators on the affected site.
The Security For WooCommerce WordPress plugin through version 1.0.16 has a vulnerability where it does not verify if the requester is authorized before regenerating secret keys and salts in the site's configuration file. This flaw allows unauthenticated users to log out every user on the site. Additionally, on servers that cannot reach the WordPress.org API, this can corrupt the configuration file and take the entire site offline.