An authorization bypass vulnerability exists in myCred up to version 4.0.0-beta.1 due to incorrectly configured access control security levels that can be exploited via a user-controlled key. This vulnerability allows an attacker with limited privileges to bypass authorization checks, potentially leading to integrity and availability impacts. The CVSS score is 5.4, indicating a medium severity level.
A stored cross-site scripting (XSS) vulnerability exists in H5P through version 1.17.9 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No patch or remediation details are provided in the available data.
CVE-2026-114702 is a stored cross-site scripting (XSS) vulnerability in the nicdark ND Shortcodes For Visual Composer plugin. It affects versions from 0 up to and including 7.8. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level with impacts on confidentiality, integrity, and availability. No public exploits or patches are currently documented.
A missing authorization vulnerability exists in yoomoney ЮKassa для WooCommerce yookassa, affecting versions up to 2.17.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or remediation information is currently available.
A vulnerability in WP Desk ShopMagic for WooCommerce (up to version 4.9.1) allows insertion of sensitive information into files or directories accessible externally. This could lead to unauthorized retrieval of embedded sensitive data. The issue is identified as CWE-538 and has a medium severity with a CVSS score of 5.3.
CVE-2026-112218 is a missing authorization vulnerability in Ahmad Majestic Support software versions prior to 1.2.2. The flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. This vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 1.2.2.
A missing authorization vulnerability exists in WP Sunshine Sunshine Photo Cart up to version 3.7.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation information is currently provided.
CVE-2026-112311 is a path traversal vulnerability in ACF Extended versions prior to 0.9.2.8. This flaw allows attackers to bypass directory restrictions and potentially access or modify files outside the intended directory. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-112241 is a critical authentication bypass vulnerability in Brainstorm Force SureCart that allows attackers to spoof authentication and abuse access. It affects SureCart versions up to and including 4.9.5. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A stored cross-site scripting (XSS) vulnerability exists in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) versions up to 0.5.9. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level.
CVE-2026-110893 is a missing authorization vulnerability in Brainstorm Force SureDash versions before 1.12.3. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. The issue affects SureDash versions from initial releases up to 1.12.2. A fix is available in version 1.12.3. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited impact on confidentiality without affecting integrity or availability.
CVE-2026-110894 is a missing authorization vulnerability in Brainstorm Force SureDash versions prior to 1.12.3. It allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3 and affects SureDash versions from 0 up to but not including 1.12.3. A fix is available in version 1.12.3.
A missing authorization vulnerability exists in the eLightUp Falcon – WordPress Optimizations & Tweaks plugin, affecting versions up to 2.12.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation details are currently provided.
An out-of-bounds read and write vulnerability exists in the Count-Min sketch deserialization of Apache DataSketches C++ versions 4.1.0 through 5.2.0. The flaw arises because the deserialization function does not properly check input size including the preamble, allowing reads beyond the input buffer. Additionally, a crafted serialized sketch can cause integer overflow in table size calculation, leading to heap memory corruption during later operations. This can cause application crashes and potentially enable further exploitation. Only applications deserializing Count-Min sketches from untrusted sources are affected. Upgrading to version 5.3.0 resolves the issue.