CVE-2026-12587 is a high-severity vulnerability in Resamania Virtuagym involving the use of hard-coded credentials. The application uses a static 'badge_number' as an HMAC private key for generating physical access QR codes. This value is accessible via an API endpoint and can be extracted from the APK due to lack of code obfuscation. An attacker with access to this key and the cryptographic logic can generate valid QR codes indefinitely, bypassing password changes or logouts.
The WooCommerce Lottery plugin for WordPress contains a high-severity SQL Injection vulnerability in all versions up to and including 2.2.9. This flaw allows unauthenticated attackers to manipulate the 'orderby' and 'order' GET parameters to inject additional SQL commands. Exploitation can lead to unauthorized extraction of sensitive database information. No official patch or remediation guidance is currently available.
CVE-2026-66153 is a high-severity vulnerability in the SonicWall NetExtender Linux client. It involves improper handling of temporary files during the NEService auto-upgrade process, allowing an attacker to manipulate file paths due to insecure link resolution before file access. This can lead to unauthorized file access or modification. No patch or official remediation guidance is currently available from the vendor. The vulnerability requires local access with low privileges and has a high attack complexity. There are no known exploits in the wild at this time.
CVE-2026-66152 is a path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component. This flaw allows an attacker to write arbitrary files with root privileges by exploiting improper handling of file paths. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.
CVE-2026-64204 is a high-severity memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. It affects NI LabVIEW 2026 Q3 (26.3.0) and earlier versions, including specific versions 23.1.0, 24.1.0, 25.1.0, and 26.1.0. The vulnerability is classified as CWE-787 (Out-of-bounds write). No official patch or remediation guidance is currently available.
CVE-2026-64203 is a high-severity memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. This affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions, including specific versions 23.1.0, 24.1.0, 25.1.0, and 26.1.0. There is no confirmed patch or official remediation available yet. The vulnerability involves an out-of-bounds read (CWE-125).
CVE-2026-64202 is a high-severity memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. The vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions, including specific versions 23.1.0, 24.1.0, 25.1.0, and 26.1.0. There is no confirmed patch or official remediation available at this time.
CVE-2026-64201 is a memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. The vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions, including specific versions 23.1.0, 24.1.0, 25.1.0, and 26.1.0. The CVSS score is 7.8, indicating a high severity level.
CVE-2026-16234 is a memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. The vulnerability affects NI LabVIEW versions 23.1.0, 24.1.0, 25.1.0, and 26.1.0. It has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided yet.
CVE-2026-16233 is a high-severity memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. The vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions, including specific versions 23.1.0, 24.1.0, 25.1.0, and 26.1.0. No official patch or remediation guidance is currently available.
An integer overflow vulnerability in NI LabVIEW allows an out-of-bounds write, potentially leading to information disclosure or arbitrary code execution. Exploitation requires a user to open a specially crafted VI file. This affects NI LabVIEW 2026 Q3 and earlier versions. The vulnerability has a medium severity score of 6.6 CVSS and no confirmed patch or official remediation yet.
CVE-2026-18444 is an integer conversion vulnerability in NI LabVIEW that causes an out-of-bounds read when loading images. This flaw may lead to information disclosure or arbitrary code execution if a user opens a specially crafted VI file. The vulnerability affects NI LabVIEW 2026 Q3 and earlier versions. The CVSS score is 6.6, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. Exploitation requires user interaction and local access.
CVE-2026-55580 is an OS command injection vulnerability in sonirico's mcp-shell prior to version 0.6.0. The vulnerability arises because the default configuration disables security checks, allowing unrestricted OS command execution by any connected client. This insecure default state is documented and results from the absence of a security policy file. The issue is fixed in version 0.6.0.
CVE-2026-55581 is an OS command injection vulnerability in sonirico mcp-shell prior to version 0.6.0. The issue arises because the default Docker security.yaml allows /bin/bash in allowed_executables, but validation only checks the first token and does not block the shell command-mode flag -c. This allows an attacker to execute arbitrary commands as the mcpuser. The vulnerability is fixed in version 0.6.0.
CVE-2026-55582 is an OS command injection vulnerability in sonirico mcp-shell prior to version 0.6.0. The default security configuration allows the use of /usr/bin/git without proper argument restrictions, enabling an attacker to inject arbitrary OS commands via Git aliases. This vulnerability can be exploited by any user with MCP connectivity, as the default Docker image runs as mcpuser with Git installed and secure mode enabled. The issue is fixed in version 0.6.0.
CVE-2026-55624 is a medium severity vulnerability in the MintyItanium Lost-Auction Minecraft plugin. Before a specific commit (88c920b05042929db334ba06d57f052b42d6b3f8), players could exploit the plugin's GUI to take items such as barrier blocks or duplicate items. This issue was fixed in the referenced commit. No affected versions are explicitly stated, and no known exploits are reported in the wild.
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
A critical authorization bypass vulnerability (CVE-2026-77995) exists in the miniOrange OAuth Client (free) extension for Joomla. Versions prior to 3.2.0 for miniOrange OAuth Client and prior to 1.2.2 for related OAuth Single Sign-On extensions are affected. The flaw allows an attacker to manipulate a cookie value to log in as arbitrary users, including administrators, leading to arbitrary account takeover.
CVE-2026-32558 is a critical unauthenticated privilege escalation vulnerability in the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin, affecting versions up to and including 8.9.1. This flaw allows an attacker to gain elevated privileges without authentication, potentially leading to full compromise of the affected system.
CVE-2026-28165 is a critical vulnerability in UnitedOver, LLC Digits software versions up to and including 9.2. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.