A reflected Cross-site Scripting (XSS) vulnerability exists in Elementor Website Builder versions up to 4.3.5. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected website.
A Missing Authorization vulnerability exists in the WP Swings Upsell Order Bump Offer for WooCommerce plugin, affecting versions up to 3.1.6. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity rating with a CVSS score of 7.1.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.
This issue affects pardus-boot-repair: from 1.0.9 before 1.1.0.
A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.
HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-123792 is an inefficient algorithmic complexity vulnerability in the Symfony Yaml component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The vulnerability causes the YAML parser to perform excessive repeated work when processing certain crafted YAML documents, leading to exponential or quadratic parsing time growth. This can keep a PHP process busy for extended periods, potentially causing denial of service. The issue affects any code parsing untrusted YAML with default flags, including some Symfony request payload mappings that accept YAML input without restrictions. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7.
Grida versions up to 0.0.24 have a missing authorization vulnerability in the Forms file-preview API routes. This flaw allows unauthenticated attackers to access form response files belonging to other organizations by leveraging exposed form and field IDs to generate signed URLs for attachments and Supabase bucket objects.
A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.
NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.
SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter.
NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.
CVE-2026-123786 is a server-side request forgery (SSRF) vulnerability in Agenta-AI's agenta product versions before 0.122.5. It allows workspace members with workflow edit permissions to redirect workflow invocations by setting arbitrary revision URLs. This can lead to unauthorized access to internal resources and secrets by capturing the Authorization token used for secret resolution. The vulnerability is fixed in version 0.122.5.
Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.
Fluxbox versions up to 1.3.7 contain an OS command injection vulnerability in the RootTheme::reconfigTheme() function. This flaw allows attackers to execute arbitrary commands by crafting style background values that include shell metacharacters. These malicious inputs are concatenated without proper escaping into an fbsetbg command executed via the shell when the style loads.
Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.
CVE-2026-123782 is an authorization bypass vulnerability in zhimaAi's ChatWiki versions before 2.10.0. It allows authenticated users to modify form fields belonging to other tenants by exploiting insecure direct object references in SaveFormField and UpdateFormRequired functions. Attackers can manipulate form_id and form_field id parameters to alter field attributes such as names, descriptions, types, and required flags, potentially disrupting data storage for submitted entries. The issue is fixed in version 2.10.0.
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and robot binding, redirecting webpage-jump commands to attacker URLs and reassigning the record to their own tenant.
Usermin versions up to 2.570 contain a cross-site scripting (XSS) vulnerability in the mailbox/detach.cgi component. This flaw allows remote attackers to execute arbitrary scripts by manipulating the 'type' parameter, bypassing JavaScript filtering. Exploitation involves sending an HTML attachment with script and tricking users into clicking a crafted detach.cgi link, enabling script execution within the victim's authenticated Usermin session.
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.
Usermin versions up to 2.570 contain an OS command injection vulnerability in the Read Mail module. Authenticated users can exploit this by creating IMAP folders with shell metacharacters via an external IMAP client. When these folders are deleted in Usermin, the unsanitized folder names allow execution of arbitrary system commands, bypassing webmail-only restrictions.