CVE-2026-59111 is a critical OS command injection vulnerability in the Ministry of the Interior (MVČR) eObčanka-Identifikace application on MacOS. Prior to version 3.6.0, the application improperly neutralizes special elements in incoming URL parameters, which are passed unsanitized to an AppleScript wrapper. This allows an attacker to register a custom URL scheme and execute parameterized commands. The vulnerability has a high CVSS score of 9.3, indicating severe confidentiality and integrity impact without availability impact. No patch or official remediation guidance is currently available.
The miniOrange Oauth Client (free) extension for Joomla contains an improper access control vulnerability that allows unauthenticated attackers to uninstall arbitrary installed extensions. This issue affects only the free versions of the miniOrange plugins and arises from a missing authentication check. The vulnerability has a high severity score of 8.8 CVSS 4.0 and can lead to significant impact by enabling attackers to disrupt Joomla installations by removing extensions without authorization.
ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.
Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.
CVE-2026-82112 is a medium severity path traversal vulnerability found in houtini-ai's houtini-lm product up to version 2.13.2. The flaw exists in an unspecified function within the src/index.ts file of the code_task_files component. This vulnerability can be exploited remotely and may allow an attacker to manipulate file paths. A patch identified by commit 35d97bca0531894da36a85aedb95312da1bd5b7a has been created to address this issue. Users are advised to apply this patch to mitigate the risk.
Unitree Robotics G1 EDU firmware up to version 1.5.2 contains multiple chained vulnerabilities in its BLE GATT server and WiFi provisioning stack. These vulnerabilities allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable and a buffer overflow. The attack involves sending crafted BLE writes to overflow a fixed buffer, corrupting a function pointer that is later invoked with root privileges.
Unitree Robotics G1 EDU firmware up to version 1.5.2 contains a high-severity unauthenticated remote code execution vulnerability. This flaw involves a chain of three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key with world-readable permissions, and a path traversal vulnerability in the chat_go knowledge upload API. Exploiting these allows an attacker to execute arbitrary commands as root without authentication.
CVE-2026-81273 is a high severity Cross-Site Request Forgery (CSRF) vulnerability affecting WP Manage Ninja's FluentBooking Pro plugin versions up to and including 2.2.4. The vulnerability allows unauthenticated attackers to perform actions on behalf of legitimate users by tricking them into submitting unwanted requests. No official patch or remediation information is currently available.
CVE-2026-81272 is a medium severity vulnerability in WP Manage Ninja's FluentPlayer Pro plugin, affecting versions up to 1.3.2. It involves broken access control due to missing authorization checks in the editor functionality, classified under CWE-862. The vulnerability allows users with high privileges to perform unauthorized actions that impact integrity without affecting confidentiality or availability.
CVE-2026-78286 is a critical vulnerability in INFINITUM FORM Geo Controller versions up to 8.9.8. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-78276 is a high-severity vulnerability in WP Manage Ninja's Fluent Boards Pro plugin, affecting versions up to and including 2.0.11. It involves PHP object injection due to deserialization of untrusted data, classified under CWE-502. This flaw can lead to complete compromise of confidentiality, integrity, and availability if exploited. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-78275 is a path traversal vulnerability in WP Manage Ninja Fluent Boards Pro affecting versions up to and including 2.0.11. It allows an editor-level user to arbitrarily delete files due to improper limitation of pathnames to restricted directories. The vulnerability has a CVSS score of 6.8, indicating medium severity, with a significant impact on availability but no direct confidentiality or integrity impact reported. No official patch or remediation guidance is currently available.
CVE-2026-78274 is a critical vulnerability in WP Manage Ninja's Fluent Boards Pro plugin, affecting versions up to 2.0.11. It involves an unrestricted file upload flaw (CWE-434) that allows users with editor privileges to upload arbitrary files, potentially leading to full system compromise. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-78273 is a medium severity cross-site scripting (XSS) vulnerability affecting WP Manage Ninja's Fluent Boards Pro plugin versions up to and including 2.0.11. The flaw allows subscribers to inject malicious scripts due to improper input neutralization during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.
CVE-2026-78271 is a high-severity vulnerability in WP Manage Ninja's FluentCRM Pro plugin, affecting versions up to and including 3.1.12. It involves incorrect privilege assignment that allows an editor-level user to escalate privileges. This flaw could lead to full compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance has been provided yet.
CVE-2026-81485 is a path traversal vulnerability in danielpopamd linkedin-ads-mcp version 1.0.0. The flaw exists in the fs.readFileSync function within the src/tools/campaign-management.ts file, specifically in the Media Upload component. This vulnerability allows an attacker to manipulate the filePath argument to access unauthorized files. The vulnerability can be exploited remotely. The issue was reported early to the project but no response or fix has been provided yet. Public exploit details have been disclosed.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.