Threats affecting pkg:bitnami/pillow

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.

CVE-2026-116401 is a vulnerability in RealMag777's HUSKY product versions up to 1.4.6 that involves missing authorization controls. This allows unauthenticated users to bypass access restrictions, potentially leading to unauthorized data exposure. The vulnerability has a high severity with a CVSS score of 7.5, indicating a network exploitable flaw with no privileges or user interaction required. No patch or remediation information is currently available.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.

CVE-2026-107868 is an unauthenticated authorization bypass vulnerability in YITH WooCommerce Product Add-Ons affecting versions up to 4.34.0. The flaw involves CWE-639, which relates to authorization bypass through user-controlled keys. This vulnerability allows an attacker without authentication to bypass authorization controls, potentially leading to unauthorized actions or modifications. The CVSS v3.1 base score is 5.3, indicating a medium severity impact primarily affecting integrity without confidentiality or availability impact.

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

CVE-2026-78527 is a high-severity vulnerability in GS Testimonial Slider versions up to 3.3.10. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with low privileges to execute code with high impact on confidentiality, integrity, and availability.

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.

Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.

CVE-2026-48201 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Fast Velocity Minify versions up to and including 3.5.7. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a user's browser. The flaw is identified as CWE-79 and does not require authentication to exploit. No patch or fixed version information is provided in the available data.

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.