BookStack versions before 26.09.3 have an authorization vulnerability in the ImageController that allows authenticated non-admin users to bypass page-level content restrictions for images whose pages are soft-deleted (moved to the recycle bin). This occurs because the permission check fails when the page is null, allowing attackers to enumerate image IDs and access metadata of restricted images. Users with certain image privileges can also modify or delete images belonging to content they cannot view, causing persistent damage even after page restoration.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain an authorization bypass and PowerShell command injection vulnerability. This flaw allows authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers by using crafted DNS suffix values. The vulnerability is addressed in version 6301.
PapaParse versions before 5.7.1 have an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service. This occurs when attackers submit delimiter-free quoted CSV input to the Papa.parse() function, causing repeated full-buffer scans that grow quadratically with input size. The result is CPU exhaustion and blocking of the Node.js event loop or freezing of browser tabs.
CVE-2026-111552 is a vulnerability in Hyper Teknoloji Ltd. Şti.'s Hyper E-Commerce Infrastructure products involving the use of single-factor authentication, which allows authentication bypass. The affected products include the core infrastructure before version 1.1, dealer integration before 1.2, and storefront application and management panel before 2.1796. This vulnerability has a high severity with a CVSS score of 7.1. Fixed versions are available for all affected components.
The Masterstudy Education WordPress Theme contains a privilege escalation vulnerability in all versions up to and including 4.8.151. The flaw arises from missing authorization and nonce validation on a specific AJAX action, allowing authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator by manipulating a transient and exploiting an auto-login flow.
The WP Table Builder plugin for WordPress versions up to and including 2.1.7 contains a stored cross-site scripting (XSS) vulnerability via the 'url' parameter. This flaw allows authenticated users with contributor-level permissions or higher to inject malicious scripts that execute when a user views the affected page. Lower-privileged users can exploit this only if explicitly permitted by an administrator in plugin settings.
Zohocorp ManageEngine DDI Central versions below 6301 are affected by a PowerShell injection vulnerability. This flaw arises from insufficient validation of user-supplied TXT record values in Windows DNS operations, allowing potential injection of malicious PowerShell commands.
The VibeBP WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 1.9.9.8.1. Authenticated users with Subscriber-level access or higher can exploit this flaw by manipulating the set_email_notification_settings() function to update their own 'wp_capabilities' user meta value, thereby granting themselves administrator privileges.
The CourseCure Courses plugin for WordPress versions up to and including 1.5.1 contains a privilege escalation vulnerability. This flaw arises from a missing capability check in the ajax_save_settings() function, allowing authenticated users with subscriber-level access or higher to modify WordPress options without proper authorization. Attackers can exploit this to set the default user role to administrator and enable user registration, thereby creating new administrator accounts.
An information disclosure vulnerability exists in the MISP Modules website component's external tools management interface. The /external_tools/list endpoint returns stored API keys in its JSON response without requiring authentication, exposing these keys to any network-reachable client. Additionally, the browser-based edit form pre-populates the API key field with the stored credential, exposing it in the DOM and client memory. This vulnerability allows attackers to obtain API keys used for authenticating submissions to external analysis or enrichment services, potentially enabling impersonation of the MISP instance or unauthorized access to external services. The impact is limited to confidentiality; no integrity or availability issues are indicated.
An untrusted URL redirection vulnerability exists in In Progress® Telerik® UI for .NET MAUI versions prior to 16.0.0. This flaw affects the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling components. An unauthenticated attacker can exploit this by crafting a document or PDF containing a link with a non-allowlisted URI scheme, which when opened by a user, can launch arbitrary operating system protocol handlers with attacker-controlled arguments.
A resource exhaustion vulnerability exists in the Qt Framework's QWebSocket and QWebSocketServer classes within the Qt WebSockets module. This vulnerability could allow an attacker to cause denial of service by exhausting resources. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No affected versions or patch information are provided, and there are no known exploits in the wild.
A host key verification flaw exists in ansible-pylibssh and the ansible.netcommon libssh connection plugin when trust-on-first-use is enabled. If a host's SSH key changes but is already present in known_hosts, the changed key is accepted without warning, allowing a man-in-the-middle attacker to impersonate the host and potentially capture credentials. Default configurations with host key checking enabled and trust-on-first-use disabled are not affected, and non-interactive runs fail closed.
The MISP Modules website component has a vulnerability in its external tools management endpoints that allows unauthenticated attackers to add, delete, modify, and toggle external tools without authorization. This occurs because the external tools handlers do not enforce the administrator authentication policy even when ADMIN_PASSWORD is set. The flaw affects the external_tools Flask blueprint and enables bypass of intended access controls. Installations without an admin password are designed to allow open management access, so the vulnerability is conditional on ADMIN_PASSWORD being configured.
CVE-2026-126643 is a cleartext storage vulnerability in the AAP Gateway Operator used in Red Hat Ansible Automation Platform 2.5 and later. The operator copies a protected resource-server secret in plaintext into the AutomationController custom resource, exposing it to any user with read access to that resource but without permission to read the original Kubernetes Secret. This breaks RBAC separation and risks disclosure of a sensitive authentication secret. The secret may also be exposed in Kubernetes API storage, GitOps histories, manifests, and audit data. Disclosure could allow impersonation of a trusted Controller service and access to privileged APIs.
A deserialization of untrusted data vulnerability exists in Telerik UI for WPF versions prior to 2026.4.1110. This flaw allows an attacker to perform unauthorized actions within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8. No known exploits are reported in the wild, and no patch links are provided in the available data.
A CRLF injection vulnerability exists in ibi WebFOCUS affecting versions 9.1, from 9.2 through 7, and from 9.3 through 7. This vulnerability involves improper neutralization of CRLF sequences, which can lead to security issues such as HTTP response splitting or header injection.
An improper control of code generation vulnerability exists in Telerik UI for WPF versions prior to 2026.4.1110. This flaw allows an attacker to execute unauthorized code within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8.
A link-following flaw exists in the authorized_key module of the ansible.posix collection, allowing an unprivileged local user to create or overwrite files in directories they do not own by replacing their ~/.ssh directory with a symlink. When an operator runs the authorized_key task as root, the module follows the symlink and writes files to the attacker-controlled location. This does not allow privilege escalation but can impact system integrity and availability, for example by disrupting package management. Exploitation requires local access and running the task as root against the symlinked path. Red Hat rates the impact as low.
A deserialization of untrusted data vulnerability exists in Telerik UI for WinForms versions prior to 2026.4.1111. This flaw allows an attacker to perform unauthorized actions within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8.