CVE-2026-108543 is a path traversal vulnerability in the ag2ai ag2 product affecting versions 0.13.0 through 0.13.4. The issue arises from improper handling of the filename argument in the os.path.join function within the UserProxyAgent component, allowing remote attackers to manipulate file paths. The vulnerability has a medium severity score of 5.3 and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation has been confirmed.
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
ImageMagick on Windows versions through 7.1.2-33 and 6.9.13-58 has an uncontrolled search path vulnerability in the NTGhostscriptEXE() function. This function launches the Ghostscript executable gswin64c.exe by its bare name when Ghostscript is not registered. An attacker can exploit this by placing a malicious gswin64c.exe in the working directory, causing it to be executed with ImageMagick's privileges during conversion of PDF, PostScript, or EPS files.
CVE-2026-62118 is a high-severity vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. It involves missing authorization controls, allowing unauthenticated users to bypass access restrictions. This flaw can lead to unauthorized information disclosure, modification, and availability impact.
CVE-2026-62117 is a high severity SQL Injection vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager affecting versions up to and including 1.13.1. The flaw allows improper neutralization of special elements in SQL commands, potentially enabling an attacker with low privileges to execute unauthorized database queries. This vulnerability impacts confidentiality and availability but does not affect integrity. No patch or remediation information is currently provided.
CVE-2026-62116 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication, potentially impacting confidentiality, integrity, and availability.
CVE-2026-42722 is a high-severity SQL Injection vulnerability affecting Frontend Admin by DynamiApps versions up to and including 3.29.13. The flaw allows an administrator-level user to inject SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and limited availability impact but does not affect integrity. No public exploits are known, and no patch information is currently available.
CVE-2026-39802 is a high-severity vulnerability in Everest Backup versions up to and including 2.3.13. It allows unauthenticated remote code execution due to improper control of code generation (CWE-94). This flaw could enable an attacker to execute arbitrary code on the affected system without any authentication.
CVE-2026-105892 is a critical path traversal vulnerability in rtCamp Inc.'s rtMedia plugin for WordPress, BuddyPress, and bbPress. It allows an attacker to improperly access restricted directories by manipulating pathnames. This affects versions from the initial release up to 4.7.13. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-62044 is a deserialization of untrusted data vulnerability in bPlugins Super Video Player up to version 1.8.13. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 7.2. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
SillyTavern versions 1.12.13 through 1.19.0 have a denial of service vulnerability due to the body-parser middleware processing large request bodies before authentication and whitelist checks. This allows unauthenticated remote attackers to send large or compressed JSON or urlencoded payloads, up to 500 MB, potentially in parallel, to exhaust server memory and CPU resources, causing service disruption.
Kortix Suna versions from 0.10.7 up to but not including 0.13.52 contain a server-side request forgery (SSRF) vulnerability. This flaw allows project managers with write permissions on project connectors to bypass IP address restrictions by using IPv6 6to4 or Teredo addresses that embed private IPv4 addresses. Exploiting this, attackers can set connector URLs to access internal services and cloud metadata endpoints, potentially reading sensitive responses. The vulnerability has a low CVSS 4.0 score of 2.3, indicating limited impact and exploitability.
CVE-2026-62045 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Booklovers product. It allows object injection and affects versions from 0 up to and including 2.13.0. The vulnerability has a high CVSS score of 9.8, indicating severe potential impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
CVE-2026-93934 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Partiso product. It allows object injection and affects versions from 0 up to and including 1.1.13. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction, leading to full confidentiality, integrity, and availability compromise.
The Embed Any Document plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'embeddoc' shortcode in all versions up to and including 2.7.13. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.