NI vulnerabilities and threats

A vulnerability in Unisoc (Shanghai) Technologies Co., Ltd. modem products T8100, T9100, and T8300 allows local information disclosure due to missing filtering of sensitive data in crash dumps. This issue does not require additional execution privileges and has a medium severity rating with a CVSS score of 5.5.

CVE-2026-87765 is a medium severity vulnerability in the Unisoc kernel apsys DVFS driver caused by improper input validation of the frequency index. This flaw can lead to out-of-bounds reads or hardware register corruption, potentially causing system instability or denial of service when exploited with local privileges.

UnicomAI Wanwu versions up to 0.6.5 contain an authorization bypass vulnerability that allows authenticated users to mint AppKeys tied to other users' MCP servers. This enables attackers to open MCP sessions and invoke server tools using the victim's upstream authentication. The vulnerability has a low CVSS score of 2.3, indicating limited impact and complexity.

UnicomAI Wanwu versions up to 0.6.5 have a missing authorization vulnerability that allows any authenticated user to revoke other users' AppKeys for arbitrary applications via the unpublish endpoint. This flaw enables attackers to delete API keys across organizations, disrupting client access to MCP and OpenAPI services. The vulnerability has a medium severity with a CVSS score of 5.3.

Wanwu versions before 0.6.3 have an insecure direct object reference vulnerability that allows any authenticated user to delete other users' legacy AppKeys by specifying a numeric apiId. This flaw enables attackers to revoke AppKeys across organizations by iterating through sequential key IDs, disrupting MCP and OpenAPI clients until new keys are issued by the owners.

UnicomAI Wanwu versions before 0.6.3 have an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' applications by manipulating the appId parameter. This flaw enables attackers to send DELETE requests with guessed sequential assistant IDs to remove victims' applications, workflows, conversations, and related data permanently.

CoreShop versions up to 1.5.5 contain an authorization bypass vulnerability in the OrderController. Authenticated customers can manipulate user-controlled IDs to act on orders belonging to other customers. This includes confirming receipt of others' orders and overwriting return tracking details by supplying crafted parameters in OrderConfirm or SendReship functions.

CVE-2026-62032 is a critical vulnerability in Designinvento's DirectoryPress plugin versions up to and including 3.6.27. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements, classified under CWE-98. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-42697 is a reflected cross-site scripting (XSS) vulnerability in the Inisev Social Share Icons & Social Share Buttons plugin (ultimate-social-media-plus). This vulnerability affects versions from initial releases up to 3.7.5. It allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.1 according to CVSS 3.1.

CVE-2026-39799 is a high-severity vulnerability in the WP File Download plugin by Joomunited. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks due to improper neutralization of input during web page generation. This affects versions up to and including 6.3.6. The vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.

CVE-2026-106610 is a critical vulnerability in the miniOrange OTP verification plugin that allows incorrect privilege assignment leading to privilege escalation. It affects versions from the initial release up to 5.5.7. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

AniWorld Downloader versions before 5.3.0 have a vulnerability in the WebUI login handler that allows unauthenticated attackers to perform unlimited authentication attempts without throttling. This flaw enables attackers to enumerate usernames based on response timing and brute-force passwords to potentially take over user accounts.

CVE-2026-97264 is a reflected cross-site scripting (XSS) vulnerability in the WPAdverts plugin by Greg Winiarski. It affects versions from initial release up to and including 2.3.4. This vulnerability allows an attacker to inject malicious scripts into web pages generated by the plugin, potentially impacting confidentiality, integrity, and availability. The CVSS score is 7.1, indicating a high severity level.

CVE-2026-97263 is a stored cross-site scripting (XSS) vulnerability in the WPAdverts plugin by Greg Winiarski. It affects versions from the initial release up to 2.3.4. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-94676 is a deserialization of untrusted data vulnerability in Tainacan Community's Tainacan product. It allows object injection and affects versions from initial releases up to 1.3.0. The vulnerability has a high severity score of 7.2 and can lead to full confidentiality, integrity, and availability compromise. No official patch or remediation details are provided in the available data.

The WP File Download plugin for WordPress contains an authorization bypass vulnerability (CWE-862) in all versions up to and including 6.3.9. This flaw allows authenticated users with subscriber-level access or higher to perform unauthorized actions such as permanently deleting files, emptying the trash, moving files between categories, and publishing or unpublishing files. The vulnerability does not affect confidentiality but impacts integrity and availability of the managed files.

The Fluent Forms plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 6.2.5. This flaw allows authenticated users with Custom-level access or higher to perform unauthorized actions such as reading private form submissions, changing submission statuses, deleting submissions permanently, and modifying global plugin settings.