A stored cross-site scripting (XSS) vulnerability exists in ThemeREX Group ThemeREX Addons (trx_addons) affecting versions up to 2.46.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
A Server-Side Request Forgery (SSRF) vulnerability exists in ThemeREX Group's ThemeREX Addons plugin (trx_addons) affecting versions up to 2.46.0. This vulnerability allows an attacker with low privileges to induce the server to make unauthorized requests, potentially leading to partial confidentiality and integrity impacts without affecting availability. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level.
YesWiki versions before 4.6.7 have a reflected cross-site scripting (XSS) vulnerability in the mail handler's field parameter. This flaw allows unauthenticated attackers to inject malicious scripts by crafting links that manipulate the ajax-mail-form action attribute, potentially executing JavaScript in the browsers of users who click these links.
CVE-2026-85087 is a medium severity vulnerability in Apache Thrift's Python bindings involving improper certificate validation and incorrect status code returns. This flaw affects versions before 0.25.0. The issue is resolved in Apache Thrift version 0.25.0. Users are advised to upgrade to this fixed version to mitigate the vulnerability.
CVE-2026-12951 is an SQL Injection vulnerability in the Dc Woocommerce Multi Vendor plugin for WordPress, specifically in the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint. Versions up to and including 5.0.18 are affected. The vulnerability arises from improper neutralization of special elements in an SQL command, allowing authenticated users with vendor-level access or higher to inject additional SQL queries. This can lead to unauthorized extraction of sensitive database information. The CVSS score is 6.5, indicating a medium severity risk.
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.
A critical vulnerability (CVE-2026-96658) in Foreman allows an authenticated attacker with low-level permissions to bypass the safemode sandbox in the templating engine, enabling remote code execution on the hosting server. This occurs due to improper handling of delegated methods, allowing unauthorized functions to be appended to the allowed execution list. The flaw affects Foreman versions 6.19.0 through 6.19.4. A security update is available in Red Hat Satellite 6.19.5 that addresses this issue.
CVE-2026-68496 is a high-severity vulnerability in the Smile parser component of FasterXML jackson-dataformats-binary. The parser fails to enforce the maxNameLength limit on JSON object property names, allowing an attacker to submit a Smile document with an unboundedly long property name. This leads to uncontrolled memory allocation and potential denial of service due to memory exhaustion. The issue affects multiple jackson-dataformats-binary versions starting from 2.16.0 where the constraint was introduced but not enforced. No special privileges are required to exploit this vulnerability.
CVE-2026-68495 is a high-severity vulnerability in the CBOR parser of FasterXML jackson-dataformats-binary. The parser does not enforce the maxNameLength limit when decoding JSON object property names in CBOR format, allowing an attacker to submit a property name of unbounded length. This can lead to memory exhaustion and denial of service due to unbounded memory allocation during parsing. No special privileges are required beyond the ability to submit data to the parser. The issue affects multiple versions starting from 2.16.0 where the maxNameLength constraint was introduced but not enforced in this parser. The vulnerability is tracked alongside a related Smile parser defect under the same vendor advisory.
A Use After Free vulnerability (CWE-416) exists in the mod_http2 module of Apache HTTP Server versions 2.4.0 through 2.4.68. This flaw is caused by shared session->bbtmp re-entrancy, potentially leading to memory corruption. The vulnerability could allow a remote attacker to cause denial of service or execute arbitrary code. No exploits are currently known in the wild. Fixes are available and have been released in updated Apache packages for multiple Ubuntu LTS versions.
CVE-2026-42356 is a vulnerability in Apache HTTP Server versions 2.4.60 through 2.4.68 where an internal redirect from CGI programs may cause the target to be incorrectly treated and executed as a CGI script. This occurs if the target is in a CGI-enabled directory and lacks another mod_mime-recognized extension. The vulnerability has a low severity rating with a CVSS score of 3.7.
A SQL injection vulnerability exists in OS4ED openSIS-Classic up to version 9.3 in the DBQuery_assignment function within the Assignment Management Endpoint. This vulnerability allows remote attackers with low privileges to manipulate the 'Tables' argument to execute SQL injection attacks. The vulnerability has a CVSS 3.1 score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. The project has been notified but has not yet responded or issued a fix. Exploit code is publicly available, but no active exploitation in the wild has been reported.
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.
anchorme versions up to 3.0.8 contain a regular expression denial of service (ReDoS) vulnerability in the IPv6 host extraction regex. This vulnerability arises from catastrophic backtracking in the regex engine when processing specially crafted input strings, which can block the Node.js event loop and cause denial of service.
CVE-2026-95351 is a use-after-free vulnerability in the Views component of Google Chrome prior to version 154.0.8037.57. It allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.
CVE-2026-95315 is a use-after-free vulnerability in the Aura component of Google Chrome prior to version 154.0.8037.57. This flaw allows a local attacker to potentially execute arbitrary code outside the browser sandbox via user interface interaction. The vulnerability has a high severity rating with a CVSS score of 7.8. Google has released an update to address this issue in Chrome version 154.0.8037.57.
CVE-2026-101261 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects an unspecified part of the /api/ZRnetwork/firstSetup_wifi endpoint, where manipulation of the login_pwd argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands remotely without user interaction. The vendor was notified but did not respond, and an exploit has been published. No patch or remediation information is currently available.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
* kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325)
* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
* kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)
* kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)
* kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)
* kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)
* kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)
* kernel: perf: Reject exited events as group leaders (CVE-2026-74753)
Bug Fix(es) and Enhancement(s):
* KVM: s390: Limit adapter indicator access to mapped page [rhel-9.8.z] (JIRA:RHEL-188656)
* crypto: xxhash64 should not be fips approved [rhel-9.8.z] (JIRA:RHEL-256437)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-101146 is an information disclosure vulnerability in Eleveo Quality Management version 9.7.0. The flaw exists in the UtilsService.createAndSaveAudit function within the GWT RPC Handler component. This vulnerability can be exploited remotely without user interaction and allows attackers to obtain sensitive information. The vendor has not responded to the disclosure, and no patch or remediation is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code has been released, increasing the risk of exploitation.