CVE-2026-113408 is a low-severity path traversal vulnerability in Git that allows an attacker to write to arbitrary files by cloning and committing to a malicious repository. This flaw affects specific Git versions including 2.50.1 through 2.56.0. The vulnerability requires local access with user interaction and does not impact confidentiality or availability.
Zohocorp ManageEngine M365 Manager Plus versions prior to 4818 contain a missing authorization vulnerability (CWE-862) in the delegated administration interface. An authenticated technician with insufficient permission validation can escalate privileges beyond their intended scope. This flaw could lead to remote code execution during administrative processing. The vulnerability is rated critical with a CVSS score of 9.9. A fix is available in version 4818.
Zohocorp ManageEngine AssetExplorer and related products contain a critical SQL Injection vulnerability (CWE-89) in the Reports module. Authenticated users with the Create Query Reports permission can exploit this flaw to execute arbitrary commands on the underlying server. Versions prior to 7860 for AssetExplorer, prior to 15290 for ServiceDesk Plus, and prior to 15150 for ServiceDesk Plus MSP and SupportCenter Plus are affected. This vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability.
CVE-2026-87772 is an incorrect authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's Pardus About software. It allows privilege escalation in versions prior to 1.2.5. The vulnerability has a high severity with a CVSS score of 7.8. A fixed version, 1.2.5, is available to address this issue.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server-Xwayland component of Red Hat Enterprise Linux 8.8. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and buffer overflow issues. The vulnerabilities affect the handling of passive grabs, RandR provider property requests, XKB geometry, GLX RenderLarge, keyboard mapping resize, and cursor input constraints. Red Hat has released an important security update addressing these issues.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include information disclosure, denial of service, remote code execution, use-after-free, and heap buffer overflow issues affecting various protocol components such as Save Session Info PDU, Surface Bits command, Server Redirection PDU, RDPGFX ResetGraphics PDU, URBDRC channel, DRDYNVC parser, RPC gateway, WinPR, and LB_LOAD_BALANCE_INFO routing token. The vulnerabilities affect Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products. Red Hat has issued security updates to address these issues.
The User Verification by PickPlugins WordPress plugin versions before 2.0.49 lacks rate limiting on the verification step of its one-time-password login and does not expire generated codes. This allows unauthenticated attackers to brute force verification codes and gain unauthorized access to any user account, including administrators, when the code is configured to use digits only.
The Clockinator Lite WordPress plugin versions before 1.1.0 have a vulnerability where the plugin does not verify authorization or ownership when updating leave requests. This flaw allows unauthenticated users to modify any leave record, including approving, rejecting, or reassigning leave requests to other users.
The Ultimate Addons for Elementor Forms WordPress plugin versions before 1.0.8 contain a vulnerability where the plugin does not properly validate the file extension of uploaded files. This flaw allows unauthenticated users to upload arbitrary files, including PHP scripts, potentially leading to remote code execution on the affected system.
The ContentPen WordPress plugin versions before 1.1.1 expose their REST API key to unauthenticated users. This exposure allows attackers to create posts containing unfiltered JavaScript, resulting in stored cross-site scripting (XSS) that executes in the browsers of any visitors, including administrators.
The TI WooCommerce Wishlist WordPress plugin versions prior to 2.0.7 contain a vulnerability where user input is not properly sanitized or escaped before being used in a SQL statement on a front-end endpoint. This flaw allows unauthenticated users to conduct SQL injection attacks.
A vulnerability in The Directorist WordPress plugin versions before 8.11.1 allows users with Subscriber-level accounts and above to bypass listing moderation by changing their own listing status from pending to published. This flaw enables unauthorized publication of listings without administrator approval.
The Order Tracking WordPress plugin versions prior to 3.6.2 have a vulnerability where the plugin does not verify that a visitor owns the customer or sales representative account for which order information is requested. Account numbers are sequential by default, enabling unauthenticated users to access the order history of any customer or sales representative, including order contact email addresses in some versions.
The Defender Security WordPress plugin versions before 6.4.1 improperly trust user-supplied IP address values without verifying their source. This flaw allows unauthenticated attackers to spoof IP addresses, bypass IP-based protections such as login lockout and IP banning, impersonate allowlisted IPs, and corrupt activity logs.
The Abilities Bridge WordPress plugin versions prior to 1.4.2 lack nonce validation when re-authenticating REST API requests from logged-in session cookies. This vulnerability enables attackers to perform Cross-Site Request Forgery (CSRF) attacks that can cause a logged-in administrator to execute arbitrary REST API actions, including creating new administrator accounts and taking over the site.
A vulnerability in the Notification API of Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files due to improper neutralization of input during web page generation. This issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.
The Crop Thumbnails WordPress plugin versions before 1.10.0 lack proper object-level authorization when reading and re-cropping media attachments. This flaw allows any authenticated user with the upload capability, such as the default Author role, to access and modify metadata and thumbnail files of media attachments owned by other users.
The Descope WordPress plugin versions before 1.2.0 contain a vulnerability where the plugin does not validate authentication tokens before creating WordPress sessions. This allows an unauthenticated attacker to obtain a session for any existing user account, including administrators, by supplying the target account's email address.
The Mine CloudVod WordPress plugin versions prior to 2.6.6 allow unauthenticated attackers to request cloud storage upload credentials via certain REST API routes. This vulnerability enables attackers to obtain signed upload policies and temporary credentials for Alibaba Cloud OSS, Tencent Cloud COS, and Dogecloud accounts configured on the site, potentially allowing them to upload or overwrite files in the site's cloud storage.
The Clockinator Lite WordPress plugin versions prior to 1.1.0 contain vulnerabilities that allow unauthenticated users to perform SQL injection attacks. These vulnerabilities stem from insufficient access restrictions on record deletion actions and the use of user-supplied table names in SQL queries without proper validation or escaping. Exploitation can lead to deletion of data from any database table and extraction of sensitive information such as password hashes.