A missing authorization vulnerability in Frappe LMS prior to version 2.54.0 allows authenticated students to submit quiz results without answer verification via a REST bypass. This can lead to unauthorized course completion and certificate issuance. Additionally, students can create quiz submissions attributed to other users, exhausting their allowed attempts and preventing legitimate submissions. The issue affects quiz result integrity and availability but does not expose other user data or elevate user roles. The vulnerability is fixed in version 2.54.0.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
CVE-2026-55551 is an improper authorization vulnerability in the infonl dimpact-zaakafhandelcomponent (ZAC) prior to version 5.2.0. It allows authenticated low-privileged municipal users to access sensitive case management data across unauthorized case types by exploiting missing authorization checks on certain by-id read endpoints. The flaw permits reading decisions, audit histories, process diagrams, and mailbox configurations without proper policy enforcement. The issue is fixed in version 5.2.0.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Two vulnerabilities were identified in the AWS Nitro Enclaves SDK for C affecting versions up to v0.4.5. CVE-2026-119116 is a use-after-free flaw in the kmstool-enclave example application that allows a parent EC2 instance application to send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code. CVE-2026-119148 is an input validation issue in the SDK library where a crafted region string can cause the enclave to accept forged AWS KMS server responses, potentially injecting malicious key material. Only enclave images including kmstool-enclave or derived code are affected by the first issue; the second affects the SDK library generally.
The npm package 'ourin-baileys' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The apex-fetch npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
Wekan versions prior to 11.11 contain a vulnerability where user-controlled input is passed to regular expressions without escaping, leading to inefficient regular expression complexity. This allows authenticated users with board membership or site-admin status to craft expressions that cause catastrophic backtracking, consuming excessive database CPU and potentially causing denial of service. The issue is fixed in version 11.11.
CVE-2026-119299 is an out-of-bounds read vulnerability in the gopacket library prior to version 1.7.2. It affects the SCTP chunk chain decoding in layers/sctp.go, where attacker-controlled lengths and counts are passed to sub-decoders without proper bounds checking. This can cause out-of-bounds or inverted slice panics, potentially terminating applications that disable decode recovery or have specific panic handling enabled. The vulnerability impacts availability only and does not lead to data disclosure or modification. The issue is fixed in gopacket version 1.7.2.
CVE-2026-115642 is an incorrect authorization vulnerability in OpenStack keystonemiddleware versions before 13.0.2. An attacker with access to a restricted application credential can bypass restrictions by supplying a custom X-Service-Token header, leading to privilege escalation.
The grizzly-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
CVE-2026-119466 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPExperts APIExperts Square for WooCommerce plugin, affecting versions prior to 4.7.6. This flaw allows an attacker to trick authenticated users into performing unwanted actions without their consent. The vulnerability has been assigned a medium severity with a CVSS score of 5.4. A fix is available in version 4.7.6.
CVE-2026-65566 is a Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine versions prior to 3.8.9. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability affects AI Engine versions from the initial release up to 3.8.8 and has a high severity rating with a CVSS score of 8.8. A fix is available in version 3.8.9.
CVE-2026-119298 is a vulnerability in croc versions prior to 11.5.2 where the receive-side file-readiness loop improperly trusts sender-controlled basenames starting with 'croc-stdin-'. This allows a remote sender, upon user acceptance of the transfer, to overwrite or truncate existing files or replace them with empty files or symlinks without confirmation. The issue is limited to predictable filenames in the 'croc-stdin-' namespace and does not affect dotfiles or symlink targets outside the receive directory. The vulnerability is fixed in version 11.5.2.
CVE-2026-119148 is a vulnerability in AWS aws-nitro-enclaves-sdk-c before version 0.4.6 involving incomplete string validation. This flaw may allow an attacker to impersonate the AWS KMS endpoint. The issue is fixed in version 0.4.6, and users are advised to rebuild any custom enclave images using the updated SDK version.
Microsoft Threat Intelligence analyzed two human-operated intrusion cases where attackers used Microsoft Teams to impersonate IT support and socially engineer users into granting remote access via Quick Assist. The attackers then staged portable runtimes, performed host and network discovery, and abused Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts. Two distinct AD CS abuse techniques were observed: ESC1 template abuse allowing certificate issuance for privileged accounts, and ESC8 NTLM relay to AD CS Web Enrollment to obtain domain-controller certificates. These certificate-based authentications enabled persistent privileged access independent of passwords. The incidents highlight risks from social engineering combined with insecure or overly permissive AD CS configurations rather than software vulnerabilities. Microsoft Defender detections and containment effectiveness varied between cases, influencing the extent of attacker progression.
CVE-2026-104623 is an authentication bypass vulnerability in SUSE Rancher Manager versions 2.11.0 up to 2.11.19, 2.12.0 up to 2.12.15, 2.13.0 up to 2.13.11, 2.14.0 up to 2.14.7, and 2.15.0 up to 2.15.3. The flaw exists in the authorization handling of the local management cluster shell feature, where some API routes bypass the intended access checks. This allows any authenticated user to run a pod on the management cluster without proper authorization. The vulnerability has a medium severity with a CVSS score of 6.3. Fixed versions are available for all affected release lines.
CVE-2026-62055 is a missing authorization vulnerability in Liquid Web / StellarWP Event Tickets plugin versions before 5.30.3. It allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions. The issue is fixed in version 5.30.3.
CVE-2026-119365 is a stored cross-site scripting (XSS) vulnerability in the Media Player Addons for Elementor – Media Player widget for WordPress. The flaw is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Versions from initial release up to 1.1.10 are affected. The vulnerability has a medium severity with a CVSS score of 6.5. It was fixed in version 1.1.11.