CVE-2026-86242 is a high-severity vulnerability in maximhq Bifrost HTTP transport versions before 2.0.0-prerelease3. It allows unauthenticated remote code execution when management authentication is disabled (the default setting). The flaw arises because Bifrost accepts a custom plugin path as an HTTP URL, downloads it, and dynamically loads it as a Go plugin, executing initialization code with the Bifrost process user privileges. This dynamic loading only succeeds on dynamically linked builds; statically linked Docker images are not vulnerable to RCE but may be susceptible to server-side request forgery. The vulnerability requires high attack complexity due to environment-specific plugin compatibility requirements. The 1.6.x line through 1.6.11 is also affected. No official patch or remediation link is provided in the data.
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file.
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
CVE-2026-85207 is a cross-site scripting (XSS) vulnerability in itsourcecode Online Medicine Delivery System version 1.0. The vulnerability arises from improper handling of the 'location' argument in the /index.php?q=orderdetails file, allowing remote attackers to inject malicious scripts. The exploit code is publicly available, but no known active exploitation in the wild has been reported. The vulnerability has a medium severity rating with a CVSS score of 5.1.
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke
`java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges.
Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection.
This issue affects KIO (Klemsan Internet Objects): before v1.9.
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
CVE-2026-82393 is a path traversal vulnerability in pnpm package manager versions prior to 10.34.5 and between 11.0.0 and before 11.11.0. It allows an attacker to craft a tarball dependency with a malicious package.json name containing scoped path traversal sequences. This leads to arbitrary file overwrites outside the node_modules directory during package installation, potentially replacing critical files such as shell startup scripts, Git hooks, or package code, which can result in code execution. The vulnerability is fixed in pnpm versions 10.34.5 and 11.11.0.
CVE-2026-77956 is a high-severity code injection vulnerability in ash-project's ash_ai component. It allows a remote, unauthenticated attacker to execute arbitrary Elixir code by exploiting the evaluation of prompt content as EEx templates. The vulnerability affects versions from 0.1.0 up to but not including 1.0.0. The issue arises because attacker-controlled input can be compiled and executed on the server without authentication. The fix involves stopping the evaluation of function-supplied prompt content as EEx templates, limiting evaluation to statically configured templates only.
A cross-site scripting (XSS) vulnerability exists in Coppermine Photo Gallery up to version 1.6.28 in the db_input.php file's Hidden Album Update Endpoint. This vulnerability can be exploited remotely and allows an attacker to inject malicious scripts. The issue is fixed in version 1.6.29. The vulnerability has a low severity rating with a CVSS score of 3.5.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a critical vulnerability (CVE-2026-19286) that allows remote attackers to execute arbitrary code via improper enforcement of security restrictions on the A2A public endpoint. This code injection flaw is due to CWE-94, improper control of code generation. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This vulnerability is identified as CWE-94 (Code Injection). It has a high severity with a CVSS score of 8.8. No official patch or remediation details are currently provided by the vendor.
TriliumNext Trilium versions up to and including 0.103.0 have a cross-site scripting (XSS) vulnerability due to improper sanitization of the book note type during import. This allows attacker-supplied scripts to execute when a malicious note is previewed. On the desktop client, this XSS can escalate to remote code execution because Node integration is enabled in the Electron renderer. The issue is fixed in version 0.104.0.
CVE-2026-53578 is a critical cross-site scripting (XSS) vulnerability in Trilium, an open-source note-taking application. Versions up to and including 0.103.0 have a flaw where the Safe import filter sanitizes HTML only for text notes but not for mindMap note types. This allows malicious HTML and JavaScript to be embedded in imported mind maps. When opened, the malicious script executes, and on the desktop client with Node integration enabled, this can escalate to remote code execution. The issue is fixed in version 0.104.0.
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.