CVE-2026-15688 is a critical vulnerability in Mitsubishi Electric Corporation's GX Works3 and Motion Control Setting software. It involves an incorrect implementation of the authentication algorithm that allows a local attacker to authenticate successfully with an invalid block password by modifying the executable module in memory. This flaw could enable unauthorized viewing, tampering, destruction, or deletion of control programs. The vulnerability has a high CVSS 4.0 score of 9.2, indicating severe impact on confidentiality, integrity, and availability. A patch is available, and the product is a cloud service, so the vendor manages remediation.
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-list in self._sort_fields. The value is resolved with getattr and passed to relationship joins and order_by, allowing requests to sort by columns hidden from column_list and by related-model columns through dotted paths. The resulting row order forms an information-exposure oracle for unexposed values, and reversing ascending and descending order confirms their relative ordering. Pairing sortBy with searchable or filterable columns and pagination can narrow the oracle toward specific values, but exact recovery depends on the application's available fields and data. This issue is fixed in version 0.27.1.
CVE-2026-81793 is a Missing Authorization vulnerability in the Dimitri Grassi Salon booking system affecting versions from initial through 10.31.9. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. There is no evidence of known exploits in the wild, and no official patch or remediation guidance has been provided yet.
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection.
This issue affects Products's Store: before 030631b2.
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.
CVE-2026-5218 is a medium severity vulnerability in Softtr Informatics Technology Trading Limited Company's E-Commerce Pack. It involves improper neutralization of script-related HTML tags, leading to a basic Cross-Site Scripting (XSS) issue. This vulnerability affects versions before 5.03.01.49. No official patch or remediation guidance is currently available.
CVE-2026-17562 is an authorization bypass vulnerability in Summit Security Systems AdisyonPro that allows unauthorized access to functionality due to improper access control enforcement. This issue affects versions before 5.21.0. The vulnerability is classified under CWE-639, indicating improper authorization checks related to user-controlled keys. The CVSS score is 6.5, reflecting a medium severity level.
CVE-2026-16286 is a critical vulnerability in TRtek Technological Products Software Repository Management that allows unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to the web server. This vulnerability affects versions before commit 2fb4acee. The CVSS score is 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-32476 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in AmpleByte Pvt Limited's Brave Conversion Engine (PRO) affecting versions up to and including 0.8.6. This vulnerability allows attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-19992 is an information disclosure vulnerability in the Orange View Limited DualSafe Password Manager & Digital Vault Extension for Chrome, affecting versions 1.4.0 through 1.4.35. The flaw involves a postMessage-based Bridge component, which can be manipulated remotely to disclose information. The attack complexity is high and exploitation is difficult. No official patch or remediation guidance has been provided by the vendor yet. The vulnerability has a low CVSS score of 2.3 and no known exploits are currently active in the wild.
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for.
to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read.
Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document.
For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of "yes" emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection.
Any caller that renders untrusted HTML lets the document choose the renderer's options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.
CVE-2026-19375 is a server-side request forgery (SSRF) vulnerability in dmitriiweb article-scraper-mcp version 1.0.0. The flaw exists in the fetch_article function of the news_scraper_mcp/server.py file, where manipulation of the url argument allows an attacker to perform SSRF attacks remotely. The vulnerability has a medium severity with a CVSS score of 5.3. Exploit code is publicly available, but no official patch or vendor response has been provided yet.
CVE-2026-28172 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Data443 Risk Mitigation, Inc.'s Tracking Code Manager versions up to and including 2.6.0. The vulnerability allows unauthenticated attackers to perform actions on behalf of a user by exploiting CSRF weaknesses. No official patch or remediation guidance is currently available from the vendor. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant risk due to its network attack vector and impact on confidentiality, integrity, and availability.