Critical severity threats

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

A critical security vulnerability in Keycloak affects versions prior to 26.7.5-r3. The issue involves jackson-databind's handling of class-name type IDs, where it validates the outer class but improperly accepts attacker-controlled classes within generic arguments. This can lead to severe impacts on confidentiality, integrity, and availability.

CVE-2026-63774 is a critical SQL Injection vulnerability in Subnet Solutions PowerSYSTEM Center 2024. It arises from insufficient input validation in the report designer component, allowing an authenticated user to execute unauthorized SQL commands. This flaw affects versions from 6.0.x through 6.2.x and 7.0.x through 7.1.x. The vulnerability has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability. No public exploits or patches are currently documented.

CVE-2026-63017 is an incorrect authorization vulnerability in Subnet Solutions PowerSYSTEM Center 2020. It allows a low-privileged, authenticated user to access resources that should be restricted to administrators. The flaw affects multiple versions of the product up to 7.1.x. The vulnerability has a critical severity with a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.

Kubeflow Pipelines versions prior to 2.18.0 contain an authorization bypass vulnerability in multi-user HTTP endpoints for pipeline uploads. This flaw allows low-privilege tenants or unauthenticated callers (if no authenticating proxy is used) to create or inject pipeline versions without proper write permissions. Exploitation can lead to execution of attacker-controlled pipeline specifications in other tenants' namespaces via recurring runs that follow the latest version. The issue is fixed in version 2.18.0.

CVE-2026-111494 is a critical vulnerability in the TPC Software Matchpoint Android app caused by improper TLS certificate validation. The app uses a TrustManager that accepts any certificate and a permissive hostname validator, allowing attackers who can intercept traffic to read and modify communications, including credentials and personal data. Additionally, the app permits unencrypted HTTP traffic, increasing exposure to interception.

CVE-2026-111490 is an authorization bypass vulnerability in the MatchPoint API by TPC Software. The API improperly trusts the 'actingasuser' HTTP header without verifying if the requester is authorized to act as the specified user. This allows attackers to manipulate user identifiers to access and modify sensitive personal, financial, and account data, including private messages and QR codes for physical access. The vulnerability enables unauthorized actions such as changing passwords, impersonating users, and transferring virtual balances.

CVE-2026-111489 is a critical vulnerability in the MatchPoint mobile app by TPC Software. A static credential embedded in the app returns an 'autorizado' token, which grants unauthenticated access to API services on the MatchPoint platform. This flaw allows attackers to bypass authentication controls and access protected API endpoints without valid credentials.

BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, have an information disclosure vulnerability that allows unauthenticated remote attackers to access .macaroon credential files for an LND node. These credentials can be used to gain full control over the Lightning Network Daemon node, including the ability to move funds, potentially leading to theft. The vulnerability is fixed in version 2.4.2.

Multiple critical vulnerabilities have been identified in the ANGLE component used by the chromium-browser within WebKitGTK, a web rendering engine ported to the GTK platform. These vulnerabilities include arbitrary code execution, information disclosure, use-after-free, buffer overflow, improper input validation, and uninitialized resource issues. Red Hat has released an update for webkit2gtk3 on Red Hat Enterprise Linux 8.4 to address these security flaws and fix a regression affecting Eclipse IDE WebKit-based views on CentOS Stream 8.

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.

Cronicle versions prior to 0.9.124 contain an incorrect authorization vulnerability that allows authenticated non-admin users with certain privileges to supply undeclared keys in event parameters. These keys can override security-sensitive environment variables used by plugins, potentially leading to privilege escalation, arbitrary code execution, data access, or service disruption. The issue is fixed in version 0.9.124.