CVE-2026-125836 is a Cross-Site Request Forgery (CSRF) vulnerability in the Simple JWT Login plugin by Nicu Micle. It affects versions from 0 up to and including 3.6.8. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.
CVE-2026-126991 is a code injection vulnerability in the Wikidata Lookup expansion module (wiki.py) of MISP misp-modules. An authenticated user can inject SPARQL syntax into queries sent to the Wikidata SPARQL endpoint, potentially altering query logic or causing error conditions that leak internal information. The vulnerability requires authenticated access and use of the wiki expansion module. It does not directly compromise the MISP server or stored data.
Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in the invoice import feature. An authenticated user with permission to create invoices can inject HTML into an invoice status field. When another authenticated user opens the invoice edit form, the injected markup is rendered unsafely, allowing execution of attacker-controlled scripts within the Akaunting origin.
CVE-2026-82292 is a low-severity NULL pointer dereference vulnerability in the Qt Framework's QDomDocument::setContent() function within the Qt XML module (qtbase). It affects Qt versions from 4.1.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.3. The flaw could cause application crashes or denial of service when processing crafted XML content. A fix is available in Qt versions 6.8.9 and 6.11.3.
KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability. No specific affected versions or technical details are provided. There is no information about patches or exploits in the wild.
CVE-2026-113408 is a low-severity path traversal vulnerability in Git that allows an attacker to write to arbitrary files by cloning and committing to a malicious repository. This flaw affects specific Git versions including 2.50.1 through 2.56.0. The vulnerability requires local access with user interaction and does not impact confidentiality or availability.
Zohocorp ManageEngine M365 Manager Plus versions prior to 4818 contain a missing authorization vulnerability (CWE-862) in the delegated administration interface. An authenticated technician with insufficient permission validation can escalate privileges beyond their intended scope. This flaw could lead to remote code execution during administrative processing. The vulnerability is rated critical with a CVSS score of 9.9. A fix is available in version 4818.
Zohocorp ManageEngine AssetExplorer and related products contain a critical SQL Injection vulnerability (CWE-89) in the Reports module. Authenticated users with the Create Query Reports permission can exploit this flaw to execute arbitrary commands on the underlying server. Versions prior to 7860 for AssetExplorer, prior to 15290 for ServiceDesk Plus, and prior to 15150 for ServiceDesk Plus MSP and SupportCenter Plus are affected. This vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability.
CVE-2026-87772 is an incorrect authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's Pardus About software. It allows privilege escalation in versions prior to 1.2.5. The vulnerability has a high severity with a CVSS score of 7.8. A fixed version, 1.2.5, is available to address this issue.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server-Xwayland component of Red Hat Enterprise Linux 8.8. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and buffer overflow issues. The vulnerabilities affect the handling of passive grabs, RandR provider property requests, XKB geometry, GLX RenderLarge, keyboard mapping resize, and cursor input constraints. Red Hat has released an important security update addressing these issues.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include information disclosure, denial of service, remote code execution, use-after-free, and heap buffer overflow issues affecting various protocol components such as Save Session Info PDU, Surface Bits command, Server Redirection PDU, RDPGFX ResetGraphics PDU, URBDRC channel, DRDYNVC parser, RPC gateway, WinPR, and LB_LOAD_BALANCE_INFO routing token. The vulnerabilities affect Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products. Red Hat has issued security updates to address these issues.
The User Verification by PickPlugins WordPress plugin versions before 2.0.49 lacks rate limiting on the verification step of its one-time-password login and does not expire generated codes. This allows unauthenticated attackers to brute force verification codes and gain unauthorized access to any user account, including administrators, when the code is configured to use digits only.
The Clockinator Lite WordPress plugin versions before 1.1.0 have a vulnerability where the plugin does not verify authorization or ownership when updating leave requests. This flaw allows unauthenticated users to modify any leave record, including approving, rejecting, or reassigning leave requests to other users.
The Ultimate Addons for Elementor Forms WordPress plugin versions before 1.0.8 contain a vulnerability where the plugin does not properly validate the file extension of uploaded files. This flaw allows unauthenticated users to upload arbitrary files, including PHP scripts, potentially leading to remote code execution on the affected system.
The ContentPen WordPress plugin versions before 1.1.1 expose their REST API key to unauthenticated users. This exposure allows attackers to create posts containing unfiltered JavaScript, resulting in stored cross-site scripting (XSS) that executes in the browsers of any visitors, including administrators.
The TI WooCommerce Wishlist WordPress plugin versions prior to 2.0.7 contain a vulnerability where user input is not properly sanitized or escaped before being used in a SQL statement on a front-end endpoint. This flaw allows unauthenticated users to conduct SQL injection attacks.
A vulnerability in The Directorist WordPress plugin versions before 8.11.1 allows users with Subscriber-level accounts and above to bypass listing moderation by changing their own listing status from pending to published. This flaw enables unauthorized publication of listings without administrator approval.
The Order Tracking WordPress plugin versions prior to 3.6.2 have a vulnerability where the plugin does not verify that a visitor owns the customer or sales representative account for which order information is requested. Account numbers are sequential by default, enabling unauthenticated users to access the order history of any customer or sales representative, including order contact email addresses in some versions.
The Defender Security WordPress plugin versions before 6.4.1 improperly trust user-supplied IP address values without verifying their source. This flaw allows unauthenticated attackers to spoof IP addresses, bypass IP-based protections such as login lockout and IP banning, impersonate allowlisted IPs, and corrupt activity logs.
The Abilities Bridge WordPress plugin versions prior to 1.4.2 lack nonce validation when re-authenticating REST API requests from logged-in session cookies. This vulnerability enables attackers to perform Cross-Site Request Forgery (CSRF) attacks that can cause a logged-in administrator to execute arbitrary REST API actions, including creating new administrator accounts and taking over the site.