Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.
Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.
An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.
The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
BookStack versions before 26.09.2 have an authorization vulnerability in the AttachmentController that allows authenticated users with attachment permissions to access draft page attachments of other users by enumerating attachment IDs. This can lead to unauthorized downloading, renaming, relinking, or replacing of files on unpublished draft pages.
Grav versions from 2.0.15 up to but not including 2.2.13 contain a vulnerability that allows attackers with page-edit permissions to bypass allowlist restrictions and invoke arbitrary public static methods. This can lead to unauthorized deletion of directories, overwriting of files, or reading files outside the intended page tree by embedding crafted fields in Flex form overrides within page frontmatter.
CVE-2026-116018 is an insecure direct object reference vulnerability in ONEARMY community-platform versions before 2.165.2. It allows authenticated users to mark other users' notifications as read by manipulating notification IDs in API requests. This can cause users in the same tenant to miss important notifications such as replies, comments, and new content alerts.
Xiaozhi-esp32-server versions before 0.9.8 have an insecure direct object reference vulnerability in the DeviceController.getAddressBook API. Authenticated users, including those with self-registered accounts, can access other users' device address books by specifying another user's device MAC address. This exposes contact MACs, aliases, call permissions, and owner user IDs.
CVE-2026-116016 is an authorization bypass vulnerability in yudao-cloud through version 2026.09. Authenticated users can bypass row-level data scope restrictions by sending a specially crafted header (data-permission-enable set to false) in /admin-api requests. This allows unauthorized reading or modification of other departments' and users' records within the same tenant.
CVE-2026-116015 is an authorization bypass vulnerability in the yudao-cloud product by YunaiV, affecting versions up to 2026.09. It allows authenticated users to access other members' after-sale operation logs by manipulating the afterSaleId parameter. This can expose sensitive information such as refund amounts, status changes, and timestamps.
CVE-2026-116013 is a vulnerability in OpenResty lua-resty-dns versions before 0.24 where improper input validation in parse_section() and _decode_name() allows attackers controlling or spoofing a DNS server to send malformed DNS responses. This causes uncaught Lua exceptions in resolver:query(), aborting DNS requests and breaking name resolution.
Ghidra versions prior to 12.2 contain a numeric truncation vulnerability in the PackedDecode::skipAttribute and skipAttributeRemaining functions. This flaw arises from storing 64-bit string lengths in 32-bit variables, which can be triggered by a crafted packed stream such as a malicious .sla file. Exploitation may allow injection of attributes into the decompiler's input or cause the decompiler process to crash. The vulnerability has a low CVSS score and does not indicate critical impact or widespread exploitation.
CVE-2026-116011 is a high-severity vulnerability in Crow versions before 1.3.4. It involves uncontrolled recursion in the crow::json::load() function, which can be triggered by sending deeply nested JSON objects. This causes the server's worker thread stack to be exhausted, leading to process termination and dropped connections.
RosarioSIS versions prior to 12.9.1 have an authorization bypass vulnerability that allows authenticated teachers to modify records for students outside their assigned course periods. By manipulating specific POST parameters in several PHP scripts, attackers can create or alter referrals, eligibility codes, attendance, and final grades for any student in the system.
Camaleon CMS versions before 2.9.3 have a path traversal vulnerability that allows users with media permissions to write arbitrary files by manipulating the name parameter with ../ sequences. This can be exploited by sending a base64 data URI to the crop_url media action, enabling attackers to write an ERB template into a theme's views directory, which executes when rendered.
DaybydayCRM versions up to 2.2.1 have a missing authorization vulnerability in the ProjectsController::updateAssign() function. This flaw allows any authenticated user, including low-privileged employees, to reassign projects without having the required permission. Attackers can send PATCH or POST requests to the /projects/updateassign/{external_id} endpoint with a chosen user_assigned_id to redirect project ownership and notifications.
The aBlocks WordPress plugin up to version 2.17.0 contains a privilege escalation vulnerability via a REST endpoint that allows authenticated users with Contributor-level access or higher to elevate their role to Editor or other non-administrator roles. This occurs because the endpoint does not properly verify permissions and reads role information from attacker-controlled content. The vulnerability is bounded to roles below administrator level.
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
The php2shell vulnerability requires multiple consecutive requests to the same PHP worker process and knowledge of the exact PHP build to exploit. Due to typical production environments having multiple PHP workers behind load balancers and constant background traffic, exploitation is impractical against moderate to high traffic sites. Exploiting the vulnerability involves a denial-of-service-like brute force approach over days or weeks, which is likely to be detected and mitigated by existing protections such as WAFs and rate limiting. While critical and deserving prompt patching, the vulnerability is mainly a practical threat to very low-traffic, unprotected sites. No confirmed successful exploitation in the wild has been observed at the time of analysis.