A missing authorization vulnerability exists in WP Sunshine Sunshine Photo Cart up to version 3.7.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation information is currently provided.
CVE-2026-112311 is a path traversal vulnerability in ACF Extended versions prior to 0.9.2.8. This flaw allows attackers to bypass directory restrictions and potentially access or modify files outside the intended directory. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-112241 is a critical authentication bypass vulnerability in Brainstorm Force SureCart that allows attackers to spoof authentication and abuse access. It affects SureCart versions up to and including 4.9.5. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A stored cross-site scripting (XSS) vulnerability exists in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) versions up to 0.5.9. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level.
CVE-2026-110893 is a missing authorization vulnerability in Brainstorm Force SureDash versions before 1.12.3. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. The issue affects SureDash versions from initial releases up to 1.12.2. A fix is available in version 1.12.3. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited impact on confidentiality without affecting integrity or availability.
CVE-2026-110894 is a missing authorization vulnerability in Brainstorm Force SureDash versions prior to 1.12.3. It allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3 and affects SureDash versions from 0 up to but not including 1.12.3. A fix is available in version 1.12.3.
A missing authorization vulnerability exists in the eLightUp Falcon – WordPress Optimizations & Tweaks plugin, affecting versions up to 2.12.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation details are currently provided.
An out-of-bounds read and write vulnerability exists in the Count-Min sketch deserialization of Apache DataSketches C++ versions 4.1.0 through 5.2.0. The flaw arises because the deserialization function does not properly check input size including the preamble, allowing reads beyond the input buffer. Additionally, a crafted serialized sketch can cause integer overflow in table size calculation, leading to heap memory corruption during later operations. This can cause application crashes and potentially enable further exploitation. Only applications deserializing Count-Min sketches from untrusted sources are affected. Upgrading to version 5.3.0 resolves the issue.
A vulnerability in the Photo Engine (Media Organizer & Lightroom) WordPress plugin before version 6.5.8 allows authenticated users with author role or higher to delete media attachments they are not authorized to, including those uploaded by other users and administrators. This is due to missing authorization checks on targeted media attachments.
The Royal MCP WordPress plugin versions before 1.5.7 contain an improper authentication vulnerability. The plugin does not restrict preview-link tokens to the specific preview they were issued for. As a result, anyone with a valid token can authenticate as the token's owning user, who is an administrator by default, across the entire REST API without requiring a nonce. This flaw allows full site takeover.
NT OneAPP by NewType Infortech has a vulnerability (CVE-2026-114223) where sensitive information such as plaintext usernames and passwords can be extracted from backup data. This occurs when an unauthenticated local attacker obtains ADB backup access authorization and the user confirms the backup operation. The vulnerability is due to cleartext storage of sensitive information in backup data. It affects versions from 0 up to and including 1.5.22. The CVSS score is 6.7, indicating a medium severity risk.
NT OneAPP by NewType Infortech contains an authentication bypass vulnerability (CWE-287) that allows unauthenticated local attackers to bypass the app's PIN lock via a deep link, gaining access to protected resources of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 6.9, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
A vulnerability in Roundcube was fixed that addressed a bug where an alias login was not properly qualified by the IMAP host. This flaw could allow an attacker with low privileges to gain unauthorized access under certain conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 6.8, indicating a medium severity impact with high confidentiality and integrity impact but no availability impact.
A vulnerability in Roundcube involves the CSS proxy content processing lacking a size limit, potentially leading to denial of service conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity impact primarily affecting availability. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A Server-Side Request Forgery (SSRF) vulnerability in Roundcube allows bypass of the is_local_url() filter via NAT64 64:ff9b::/96 addresses. This vulnerability affects multiple specific versions of Roundcube and has a high severity rating with a CVSS score of 7.2. The flaw could allow an attacker to cause the server to make unauthorized requests, potentially leading to information disclosure or other impacts.
A vulnerability in Roundcube allows bypassing remote content blocking via SVG SMIL by attribute. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require privileges or user interaction to exploit and impacts confidentiality without affecting integrity or availability.
A vulnerability in Roundcube allows bypassing remote content blocking via CSS escapes in FuncIRI attributes. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require user interaction or privileges and impacts confidentiality by potentially allowing remote content to be loaded despite blocking mechanisms.
A high-severity vulnerability (CVE-2026-114727) in Roundcube involves unsafe handling of attachment content passed to ImageMagick during image resizing. This flaw could lead to high impact on confidentiality, integrity, and availability. Multiple specific versions of Roundcube are affected. The vulnerability has a CVSS score of 8.3, indicating a serious risk. No public exploits are known in the wild. The product is not a cloud service, and no explicit patch information is provided in the input.