CVE-2026-115951 is a stored cross-site scripting (XSS) vulnerability in Kevin Weber's Lazy Load for Videos plugin affecting versions before 2.18.12. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that can be executed in the context of other users. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The issue is fixed in version 2.18.12.
CVE-2026-111497, dubbed Node2Shell, is a critical out-of-bounds write vulnerability in Google’s Brotli decoder affecting versions 1.0.3 through 1.2.0. It impacts multiple platforms including Node.js, .NET, PowerShell, and Python packages, allowing unauthenticated attackers to cause memory corruption that can lead to process crashes, memory leaks, or arbitrary code execution. The flaw has been patched in Brotli versions 1.0.10, 1.1.1, and 1.2.1, with corresponding updates released by Microsoft, Node.js, and Python package maintainers. No exploitation in the wild has been reported, but proof-of-concept code demonstrates code execution on certain Linux arm64 Node.js builds. The vulnerability arises when attacker-controlled compressed data is processed by the affected Brotli decoder.
CVE-2026-116256 is a server-side request forgery (SSRF) vulnerability in the geesondog RhaPHP project affecting the image function in application/mp/controller/Show.php within the Mp Module Media Proxy component. The vulnerability allows remote attackers to manipulate the 'url' argument to induce SSRF. The product uses a rolling release model, so no specific affected or fixed versions are provided. The vendor did not respond to disclosure attempts. Public exploit code is available. The CVSS 4.0 base score is 6.9, indicating medium severity.
CVE-2026-115948 is a Blind SQL Injection vulnerability in David Lingren's Media Library Assistant affecting versions prior to 3.43. The flaw allows an attacker with low privileges to execute unauthorized SQL commands, potentially leading to high confidentiality impact and limited availability impact. A fix is available in version 3.43.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.
Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
CVE-2026-116255 is a path traversal vulnerability in PGYER codefever affecting the _detail function in application/controllers/doc.php. The flaw allows remote attackers to manipulate the uri_string argument to perform path traversal. The product uses a rolling release model, so specific affected versions are not provided. A patch identified by commit e4433eee96883a222403854e8ac38b3146774a07 is available to fix the issue. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1.
CVE-2026-4316 is a reflected Cross-Site Scripting (XSS) vulnerability in the IsMyGym software by Zuinq Studio. It affects the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser context. This vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No affected versions or patch information is provided.
CVE-2026-116254 is a medium severity vulnerability in rathena FluxCP affecting the PayPal IPN Handler's origin validation. The flaw exists in the verifyiprange function of lib/Flux/PaymentNotifyRequest.php, where manipulation of the X-Real-IP header can bypass origin checks. This vulnerability can be exploited remotely without authentication. Public exploit code is available, but no vendor response or patch has been provided.
CVE-2026-112250 is a vulnerability in Bizerba SE & Co. KG's BRAIN2 software up to version 3.09. Under certain installation conditions, the password for a Windows service account may be written in cleartext to a setup log file. This occurs when Microsoft SQL Server access is configured with Integrated Security and the Windows account running the BRAIN2 MainService is specified during installation. The log file is stored in the temporary directory of the Windows administrator performing the installation, which is typically accessible only to users with administrative privileges. This vulnerability could lead to credential disclosure of the BRAIN2 service account. A fix is available in version 3.10.
This report is a guest diary entry analyzing web traffic logs collected by a SANS DShield honeypot over approximately three weeks. The analysis focuses on identifying anomalous HTTP requests by examining language preferences indicated in the Accept-Charset HTTP header, specifically noting requests that prefer the GBK character set used for Simplified Chinese. The author narrows down suspicious traffic by filtering on this header and observes a small set of requests originating from Beijing. The diary illustrates a methodical approach to data exploration using Elastic Kibana to find unusual patterns in large datasets, but does not describe a specific vulnerability or active exploit.