Threat database

CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, results, and associated security reports. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the Notes field of the Checklists feature in Cervantes version v1.3-beta. This flaw allows an attacker to inject malicious scripts that execute in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation information is currently available, and there are no known exploits in the wild.

Cloudflare has introduced a post-quantum (PQ) GeoKey Manager that restricts decryption keys to be unwrapped only within designated geographic regions. This system uses hybrid post-quantum cryptography (ML-KEM-768 plus X25519) to protect keys, ensuring that regional root keys never leave their authorized regions and are stored only in volatile kernel memory on authorized edge servers. The GeoKey Manager supports data sovereignty by enforcing geographic boundaries on key usage, preventing decryption outside the chosen region. It is currently in closed beta with general availability planned for Q1 2027.

Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.

This content announces the creation of an AI Security Wiki and an AI Secure by Design project, which provide a comprehensive, vendor-neutral resource for AI security governance, risk management, architecture, standards, and compliance. The authors emphasize that many recent AI-related security incidents stem from failures in fundamental security practices rather than AI technology itself. The projects aim to help organizations integrate security fundamentals into AI development and deployment to mitigate risks associated with AI-assisted attacks.

CVE-2026-115975 is a broken access control vulnerability in the JiraController component of CervantesSec's cervantes product version v1.3-beta. This flaw allows an attacker with some privileges to create, edit, or delete Jira tickets related to vulnerabilities in projects they should not have access to. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-115803 is an authorization bypass vulnerability in Scada-LTS version 2.8.0. It affects the AmCharts Data API component, specifically the HttpServletRequest.getParameter function in the AmChartValuesAPI.java file. Manipulating the 'ids' argument can allow an attacker to bypass authorization controls remotely. The vendor is currently working on a new release with security enhancements to address this issue. No patch is available yet.