Threat Intelligence Database

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.

This content announces the creation of an AI Security Wiki and an AI Secure by Design project, which provide a comprehensive, vendor-neutral resource for AI security governance, risk management, architecture, standards, and compliance. The authors emphasize that many recent AI-related security incidents stem from failures in fundamental security practices rather than AI technology itself. The projects aim to help organizations integrate security fundamentals into AI development and deployment to mitigate risks associated with AI-assisted attacks.

CVE-2026-115975 is a broken access control vulnerability in the JiraController component of CervantesSec's cervantes product version v1.3-beta. This flaw allows an attacker with some privileges to create, edit, or delete Jira tickets related to vulnerabilities in projects they should not have access to. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-115803 is an authorization bypass vulnerability in Scada-LTS version 2.8.0. It affects the AmCharts Data API component, specifically the HttpServletRequest.getParameter function in the AmChartValuesAPI.java file. Manipulating the 'ids' argument can allow an attacker to bypass authorization controls remotely. The vendor is currently working on a new release with security enhancements to address this issue. No patch is available yet.

CVE-2026-115802 is a medium severity vulnerability in InternScience InternAgent version 1.5.0. It involves a weakness in the train function of the file tasks/AutoChem/code/experiment.py within the LoRA Loading component. The vulnerability allows inclusion of functionality from an untrusted control sphere due to manipulation of the argument base_model_name_or_path. The attack can be initiated remotely and exploit code is publicly available.

CVE-2026-108013 is a vulnerability in HCL Software BigFix Platform related to the use of an outdated Mozilla CA certificate bundle. Versions of the bundle dated before 2026/10/20 trust certificates whose private keys have been compromised, allowing an on-path attacker to impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by updating to the bundle version dated 2026/10/20 or later, available starting from BES Support v1520.

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.