CVE-2026-105154 is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Roller versions 4.0 through 6.1.6 affecting the Planet feed aggregator administration. An unauthenticated attacker can induce a logged-in global administrator to trigger the addition of a Planet subscription by visiting a crafted web page. This allows the attacker to make the server fetch arbitrary URLs, including internal addresses, and publish fetched feed content without authentication. The vulnerability arises because recent versions accept GET requests for this action, which are not protected by CSRF tokens. Apache Roller 6.1.7 and later address this issue by requiring POST requests with valid CSRF tokens and disabling the Planet aggregator by default.
CVE-2026-124416 is a missing authorization vulnerability in Ahmad WP Job Portal versions prior to 2.8.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue affects all versions from initial releases up to 2.7.2. A fix is available in version 2.8.0. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-105153 is an XML External Entity (XXE) vulnerability in Apache Roller versions 4.0 through 6.1.6. It allows any authenticated user, even without weblog permissions, to read files accessible by the Roller process and to cause the server to make outbound HTTP requests to attacker-controlled destinations. This occurs because the AtomPub endpoint parses Atom entries with an XML parser configuration that permits external entities and DTD subsets before authorization checks or feature enablement checks. The vulnerability is fixed in Apache Roller 6.1.7 and later, which use a hardened XML parser configuration and reject AtomPub requests when the feature is disabled.
CVE-2026-125778 is a medium severity vulnerability in the myCred plugin affecting versions prior to 4.0.3. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability is fixed in version 4.0.3.
Apache Roller versions 4.0 through 6.1.6 contain a vulnerability that allows a weblog administrator to access another user's stored password hash by creating a custom weblog template. This occurs because the template can access the underlying persistent objects directly via a public accessor, bypassing intended data wrappers. The issue affects any weblog where the administrator can author templates without requiring non-default configurations. The vulnerability is addressed in Apache Roller 6.1.7 and later versions.
CVE-2026-124263 is a Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator versions prior to 3.9.76. This flaw allows an attacker to trick authenticated users into submitting unwanted requests, potentially causing limited integrity and availability impacts. The issue is fixed in version 3.9.76.
Apache Roller versions 4.0 through 6.1.6 contain a vulnerability where any logged-in user can infer other users' email addresses by exploiting the user search functionality. The search matches input against email addresses as well as user names, allowing incremental confirmation of email addresses one character at a time. This issue is fixed in Apache Roller 6.1.7 and later, where the search for non-administrators only matches user names.
CVE-2026-125431 is a missing authorization vulnerability in the Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized modifications. The issue affects versions prior to 6.0.8 and has been fixed in version 6.0.8. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-124261 is a missing authorization vulnerability in Magepeople inc.'s Taxi Booking Manager for WooCommerce plugin. Versions from initial release up to 2.1.7 are affected. The flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized modifications. The issue is fixed in version 2.2.9.
CVE-2026-125776 is a missing authorization vulnerability in Cozmoslabs Profile Builder versions prior to 4.0.7. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to certain profile builder functionalities. The issue is fixed in version 4.0.7.
CVE-2026-124496 is an authorization vulnerability in Apache Storm versions 3.0.0 up to but not including 3.2.0. The DRPC HTTP endpoint allows an authenticated user to impersonate another user without proper authorization checks, enabling execution of DRPC functions restricted to that other user. This issue is fixed in Apache Storm version 3.2.0.
CVE-2026-125450 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force's SureRank plugin affecting versions prior to 1.11.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. A fix is available in version 1.11.0.
CVE-2026-125762 is a stored cross-site scripting (XSS) vulnerability in LeapWorx Premium Addons for Elementor affecting versions prior to 4.11.117. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in version 4.11.117.
CVE-2026-124495 is a vulnerability in Apache Storm versions 3.0.0 up to but not including 3.2.0. It involves the Logviewer serving files via symbolic links placed by workers running as the topology owner, allowing users who can submit topologies to read logs and other files accessible to the Logviewer process. The issue is fixed in version 3.2.0.
Ninja Forms - File Uploads WordPress add-on up to version 3.3.36 contains a critical path traversal vulnerability allowing unauthenticated attackers to delete arbitrary files on the server. The flaw arises from improper handling of client-supplied file paths in background upload processing, bypassing directory containment checks. Deleting key files like wp-config.php can force WordPress into setup mode, enabling full site takeover.
CVE-2026-125045 is a stored cross-site scripting (XSS) vulnerability in John-Michael L'Allier's Create software. It affects versions from initial releases up to 3.1.1. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of other users. A fix is available in version 3.1.2.
CVE-2026-94125 is a missing authorization vulnerability in Apache Storm's Nimbus component. It allows an authenticated user with access to Nimbus to obtain worker placement details of topologies they are not authorized to view, including host, port, owner, and resource assignments. This information disclosure affects multi-tenant clusters. The issue is fixed in Apache Storm version 3.2.0.
CVE-2026-124745 is a vulnerability in BusyBox's tar utility where deferred hardlink targets are improperly resolved across symbolic links pointing outside the intended extraction directory. This flaw allows an attacker to craft an archive that can overwrite arbitrary files on the system during extraction. The vulnerability is rated as moderate severity because exploitation requires local user interaction to extract a specially crafted archive, and typically requires subsequent extraction operations to achieve unauthorized file modification. In Red Hat environments, exposure is minimal since BusyBox tar is mainly used in constrained environments like initramfs or recovery images, while GNU tar is the standard for general extraction tasks. No mitigation or fix currently meets Red Hat's criteria for deployment and stability.
CVE-2026-124744 is a moderate severity vulnerability in BusyBox's cpio utility used in Red Hat Hardened Images. The flaw involves improper sanitization of hardlink target paths when extracting files with path traversal protection enabled. This can allow an attacker to create hardlinks pointing outside the intended extraction directory, potentially modifying or overwriting arbitrary files during extraction. Exploitation requires tricking a user or automated process into extracting a crafted archive. The vulnerability primarily affects specialized environments like rescue tools or recovery images where BusyBox is used as the archive extractor. No official fix or mitigation currently meets Red Hat's criteria for deployment.
CVE-2026-126663 is a path traversal vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag by exploiting incorrect validation order of paths. Attackers can use percent-encoded sequences to bypass the Validator::isInsecurePath() check, causing the frontend to serve files outside the intended directory.