NI vulnerabilities and threats

CVE-2026-82924 is an improper control of interaction frequency vulnerability in Expert Mail by Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. This flaw allows brute force attacks due to insufficient rate limiting or interaction controls. The vulnerability affects versions of Expert Mail up to and including 2026-09-18. It has a medium severity with a CVSS score of 5.3, indicating limited confidentiality impact and no integrity or availability impact.

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

CVE-2026-39769 is a high-severity authentication bypass vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor plugin. It allows attackers to exploit the password recovery mechanism via an alternate path or channel, bypassing authentication controls. The vulnerability affects versions from the initial release up to 3.1.12 inclusive.

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.

Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

CVE-2026-82989 is a critical input injection vulnerability in the vCast network services of ViewSonic ViewBoard devices. It allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints. This flaw affects versions from 0.0.0 up to and including 3.2.715. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability.

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data and using the server as a network pivot. This issue is fixed in version 1.13.0.

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/&lt;app_id&gt;/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.

Canimaan Software ClamXAV versions 3.3 through 3.11 contain a local privilege escalation vulnerability due to a race condition and insufficient file validation in the Privileged Helper Tool. This flaw allows a local attacker to execute arbitrary code with system privileges. The issue is fixed in version 3.11.1.