A vulnerability in the WPS Bookings for WooCommerce WordPress plugin versions before 3.13.1 allows unauthenticated users to manipulate the price of bookable services by submitting arbitrary price values. This lack of input validation can enable attackers to purchase services at a price of their choosing, including zero.
The ARForms WordPress plugin up to version 7.2.4 contains an arbitrary file upload vulnerability via its form file-upload handler. An attacker can upload malicious files with executable PHP code by exploiting insufficient validation of file names and bypassing file-type and content checks. This vulnerability allows unauthenticated attackers to potentially achieve remote code execution if a form with a File field is publicly accessible on the site.
HCL Leap contains a stored cross-site scripting (XSS) vulnerability in the Manage page dialogs via malicious application titles. This flaw allows attackers to execute scripts in the context of a user's session, potentially leading to session takeover. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No specific affected versions or patches are currently documented.
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin versions 1.6.22 through 1.7.3 contains a vulnerability where required paid product options are not properly validated. This allows unauthenticated users to add products to the cart and complete orders without paying the surcharge for required options, paying only the base product price.
A vulnerability in the group-move and organization group reparenting endpoints of the keycloak-services component in the Red Hat build of Keycloak allows delegated administrators to escalate privileges. The flaw arises because the system does not verify if the target parent group confers administrative roles when a group is moved. Exploiting this, an attacker can move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm. The issue is a missing authorization check and represents an incomplete fix for a previous vulnerability (CVE-2026-94000).
HCL Domino Leap contains a stored cross-site scripting (XSS) vulnerability via malicious application titles in Manage page dialogs. This vulnerability allows an attacker to execute arbitrary scripts in the context of a user's session, potentially leading to session takeover. The vulnerability has a CVSS score of 6.8, indicating a medium severity impact. No affected versions or patch information are provided, and no known exploits are reported in the wild.
The ARforms WordPress plugin up to version 7.2.4 is vulnerable to stored cross-site scripting (XSS) via the Referer header. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The flaw exists due to insufficient input sanitization and output escaping in the plugin's AJAX handler for saving incomplete form data, which is accessible without authentication.
A vulnerability in the ProfilePress WordPress plugin versions before 4.17.6 allows unauthenticated users to bypass configured restrictions on role and user meta filters in member directories. This enables attackers to list accounts that were intended to be hidden and to access user meta values of those listed users.
The GetPaid WordPress plugin versions 2.8.63 and 2.8.64 have a vulnerability where item quantities on payment forms are not validated as whole numbers. This flaw allows unauthenticated users to create invoices for priced items that can be marked as paid without actual payment.
Zoho Corporation ManageEngine ADAudit Plus versions below 8703 contain an authenticated SQL injection vulnerability in the Reports API. This vulnerability allows an attacker with valid credentials to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity score of 8.8 (CVSS 3.1).
Zoho Corporation ManageEngine ADAudit Plus versions below 8711 contain an authenticated second order SQL injection vulnerability in the custom reports module. This vulnerability allows an attacker with valid credentials to execute malicious SQL commands indirectly, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity with a CVSS score of 8.8. No explicit patch or remediation details are provided in the available data.
The NotificationX WordPress plugin versions before 3.3.7 lack capability, authentication, and nonce checks on its notification preview path. This flaw allows unauthenticated users to view private, draft, pending, and password-protected post content and execute arbitrary registered shortcodes by sending crafted preview data in front-end requests.
A vulnerability in certain versions of Octopus Server allows users with limited privileges to escalate to Administrator due to insufficient integrity protection of authentication cookies and improper permission validation. This flaw enables unauthorized viewing of users or audit events and privilege escalation.
A vulnerability in certain versions of Octopus Server allows users authenticated via LDAP with self-service login editing enabled to escalate their permissions. Due to incorrect validation of user-assigned permissions, affected users can modify their own login identities to gain elevated privileges, potentially reaching system administrator level.
The ARforms WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'description' parameter in all versions up to and including 7.2.4. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The injected payload is processed through maybe_unserialize(), and if it contains a 'referrer' key, attacker-controlled values are rendered unescaped in the admin entry detail view.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server-Xwayland component of Red Hat Enterprise Linux 9.4. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and buffer overflow issues. The vulnerabilities affect the X server running X clients under Wayland, specifically in passive grab handling, RandR provider property requests, XKB geometry handling, GLX RenderLarge, keyboard mapping resize, input cursor constraints, and XKB keycode handling.
Two vulnerabilities, CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks, have been exploited by threat actors to leak sensitive information including configuration data. The Openwave flaw allows authenticated users to bypass file-type restrictions to convert unintended document types, potentially exposing sensitive data. The Cisco BroadWorks vulnerability is a remote, unauthenticated XML external entity injection that permits reading sensitive configuration information. Both vulnerabilities have been patched by their respective vendors. The U.S. CISA has added these flaws to its Known Exploited Vulnerabilities catalog and urges patching by November 24, 2026. Exploitation campaigns have targeted telecommunications providers and their customers, focusing on asset enumeration, credential theft, and subscriber data harvesting.
Multiple security vulnerabilities affecting Grafana and related Golang components have been addressed in a Red Hat Enterprise Linux 10 update. These include privilege escalation, unauthorized access, denial of service, cross-site scripting, and code execution flaws. The update fixes issues such as privilege escalation via dashboard overwrite, incorrect IPv6 allow-list defaults causing unauthorized access, denial of service via unbounded memory growth and large API payloads, and plugin archive extraction allowing code execution. Several Golang libraries used by Grafana are also patched for denial of service and cross-site scripting vulnerabilities.