CVE-2026-61991 is a critical unauthenticated remote code execution vulnerability affecting AjaxLoadMore Cache versions up to and including 3.1.1. This flaw allows an attacker to execute arbitrary code remotely without any authentication, posing a severe risk to confidentiality, integrity, and availability.
CVE-2026-54858 is a critical unauthenticated PHP Object Injection vulnerability affecting Printy versions up to and including 1.13.0. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise with high confidentiality, integrity, and availability impact.
CVE-2026-54856 is a critical unauthenticated PHP Object Injection vulnerability affecting RexCoin versions up to 1.2.6. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.
A PHP Object Injection vulnerability exists in YayMail versions up to and including 4.4.6. This flaw allows a shop manager with high privileges to potentially execute malicious object injection attacks. The vulnerability is identified as CVE-2026-42701 and has a high severity rating with a CVSS score of 7.2.
CVE-2026-54860 is a critical unauthenticated PHP Object Injection vulnerability affecting Ozisti versions up to and including 1.1.10. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.
A Cross-Site Scripting (XSS) vulnerability exists in Themeum Kirki kirki up to version 6.4.0 due to improper neutralization of script-related HTML tags. This vulnerability allows an attacker with low privileges to inject code that can be executed in the context of other users' browsers. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.
A vulnerability in Barn2 Plugins Document Library Lite (up to version 1.3.0) allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. The issue is identified as CVE-2026-48200 and has a medium severity rating with a CVSS score of 5.3.
CVE-2026-54859 is a critical unauthenticated PHP Object Injection vulnerability affecting Preservation software versions up to and including 1.15. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Post Video Players versions up to and including 1.165. This vulnerability allows attackers to inject malicious scripts without authentication.
CVE-2026-54857 is a critical unauthenticated PHP Object Injection vulnerability affecting Quirky versions up to and including 1.23. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.
Frappe versions before 15.121.0 and 16.x before 16.34.0 have a path traversal vulnerability in their file upload handling. This flaw allows authenticated attackers to upload files outside the intended storage directory, potentially leading to remote code execution on the server. The vulnerability is critical with a CVSS score of 9.9.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote attacker to execute stored Python component code within a public workflow. This execution occurs under the flow owner's runtime context on the server, bypassing intended trust boundaries that restrict public execution to server-trusted code. The vulnerability is identified as CVE-2026-18894 and has a medium severity rating with a CVSS score of 6.5.
A broken access control vulnerability exists in LearnPress versions up to and including 4.4.10, allowing subscribers to potentially access unauthorized functionality or data.
CVE-2026-27394 is an unauthenticated cross-site scripting (XSS) vulnerability affecting Eventer versions up to and including 0.1.1. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.
CVE-2026-20942 is a medium severity vulnerability in Microsoft Edge (Chromium-based) involving improper restriction of rendered UI layers or frames. This flaw allows an unauthorized attacker to perform spoofing attacks over a network by manipulating the user interface presentation. The vulnerability does not impact confidentiality, integrity, or availability beyond the potential for user interface spoofing.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in WP Crowdfunding versions up to and including 2.2.2. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This occurs when dropping the Future returned by TypedFunc::call_async causes a panic in the host. The issue arises because if the guest task has not started, the cleanup code unwraps an error while searching for work items, leading to a crash in embedders that cancel pending calls.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This flaw allows malicious components to cause the host to panic via thread.yield calls in start functions, leading to a crash of the embedding environment.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a denial of service vulnerability. This flaw allows malicious WebAssembly modules to cause the host to panic due to improper handling of the may_leave flag during memory reallocation (realloc). Attackers can exploit this by invoking host calls during realloc operations, leading to crashes.
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a leftover assertion in the component::Func::call function. This assertion rejects guest exports using the async ABI option. An attacker supplying a component with an async-lifted export can cause the host process to crash when the embedder invokes that export via Func::call.