The Post Export Import with Media plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 1.17.1. Authenticated users with administrator-level privileges can exploit this flaw by uploading a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the 'file_path' parameter. This allows reading arbitrary files on the server, potentially exposing sensitive information. The vulnerability bypasses extension checks introduced in version 1.13.2. The CVSS score is 4.9, indicating medium severity.
The Smart Popup by Supsystic WordPress plugin is vulnerable to SQL Injection via the 'sidx' parameter in versions up to and including 1.13.2. This vulnerability allows authenticated users with administrator-level privileges to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability has a medium severity rating with a CVSS score of 4.9.
CVE-2026-89301 is a high-severity vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress. It affects all versions up to and including 4.7.13. The flaw involves missing authorization checks that allow unauthenticated attackers to delete arbitrary safe files on the server by exploiting insufficient file path validation. Additionally, a public nonce used for uploads is exposed in frontend JavaScript, making it accessible to unauthenticated visitors.
The FireBox – WooCommerce Popup Builder plugin for WordPress contains an SQL Injection vulnerability in the FireBox Form Display Condition feature. This affects all versions up to and including 3.1.13. Authenticated attackers with author-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. On fresh installs of version 3.1.10 and later, exploitation requires administrator-level access, but on upgraded sites from versions prior to 3.1.10, the required privilege is reduced to author-level due to a migration issue.
The Advanced IP Blocker WordPress plugin up to version 8.13.13 contains a critical authentication bypass vulnerability. This flaw allows unauthenticated attackers to bypass two-factor authentication (2FA) by exploiting improper server-side checks and nonce reuse. Attackers can brute-force a 6-digit TOTP code without rate limiting or lockout, gaining full authenticated sessions and potentially complete site takeover. Exploitation requires only knowledge of a valid user ID with 2FA enabled. The vulnerability is tracked as CVE-2026-104732 with a CVSS score of 9.8.
Multiple security issues were addressed in the xwayland-24.1.13-2.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by several CVEs. No specific affected versions are detailed beyond this package version. The overall severity is assessed as medium.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability due to improper validation of counts, offsets, lengths, and field boundaries in FRM metadata when opening binary FRM files. This can allow an attacker who can place a crafted FRM file in the data directory to cause out-of-bounds reads or writes, potentially crashing the server or executing arbitrary code. The issue is fixed in the versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A vulnerability in MariaDB server's view FRM parser allows improper encoding of newline characters in usernames. This flaw affects multiple MariaDB versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. An attacker with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges could craft a username that embeds additional view metadata, causing the parser to misinterpret it as security metadata and potentially escalate privileges. The issue is fixed in the stated fixed versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107818 is a high-severity vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves external control of system or configuration settings via the mariadb.service unit using the /run/mysqld/wsrep-new-cluster file during service restart. A database user with FILE privilege and appropriate secure-file-priv settings could create this file and inject attacker-controlled environment variables, potentially compromising confidentiality, integrity, and availability. The issue is fixed in the stated versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107816 is an out-of-bounds read vulnerability in the MariaDB server's qc_info plugin affecting multiple versions from 10.6.1 through versions prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs when a query containing embedded null bytes is cached, and subsequent reading of information_schema.query_cache_info may access memory beyond the allocated buffer, potentially disclosing adjacent memory or causing a server crash. The issue has been fixed in the specified later versions.
MariaDB server versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 have a vulnerability where the mysql service account's home directory is set to the database data directory. This allows a database user with FILE privilege to write startup dot-files such as .bash_profile that execute when an administrator opens a login shell for the mysql account. Debian packages are not affected due to using /nonexistent as the home directory. The issue is fixed in the listed fixed versions.
## Summary
Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a JWT and no step-up. An authenticated user whose JWT is stolen or persisted, but who does not hold a fresh secure-session, can perform cluster node CRUD (including reading and rewriting a node token secret) and trigger cluster-wide nginx reload/restart. Confirmed at HEAD 2cb7ee9102c9d87274de2fa104db804841d140a0.
## The defect
GHSA-5v7c-xpfp-p65m required a fresh secure session (an OTP step-up beyond the JWT) for sensitive mutation routes. The fix wrapped the nginx, cert, dns, backup, site, and stream mutation handlers in middleware.RequireSecureSession() and added reload/restart to the MCP sensitive-tool list. It did not touch the physically separate api/cluster package, whose router registers the same class of sensitive operations on the bare authenticated group.
The fixed sibling, api/nginx/router.go:
```go
o := r.Group("", middleware.RequireSecureSession()) // line 28
{
o.POST("nginx/reload", Reload) // line 30
o.POST("nginx/restart", Restart) // line 31
}
```
The missed router, api/cluster/router.go, registers every sensitive operation directly on r with no RequireSecureSession wrapper:
```go
nodeGroup := r.Group("nodes") // line 9, no step-up
{
nodeGroup.POST("", AddNode) // line 12
nodeGroup.POST("/:id", EditNode) // line 13
nodeGroup.DELETE("/:id", DeleteNode) // line 14
}
r.POST("nodes/reload_nginx", ReloadNginx) // line 17
r.POST("nodes/restart_nginx", RestartNginx) // line 18
r.POST("namespaces", AddNamespace) // line 22
r.POST("namespaces/:id", ModifyNamespace) // line 23
r.DELETE("namespaces/:id", DeleteNamespace) // line 24
```
Both routers mount on the same group in router/routers.go: `g := root.Group("/", middleware.AuthRequired(), middleware.Proxy())` (line 87); nginx.InitRouter(g) creates its own RequireSecureSession subgroup, cluster.InitRouter(g) does not. So the cluster routes inherit only AuthRequired and Proxy, exactly the pre-fix posture the advisory closed for the nginx routes. AuthRequired has no role gate, so any authenticated user reaches them.
## Attacker model and impact
An authenticated, OTP-enabled user who does not present a fresh X-Secure-Session-ID (the parent advisory's model: a stolen or persisted JWT used without the step-up). Such a user can: add/edit/delete cluster nodes (AddNode/EditNode store an AES-serialized node token, the secret used to control a remote node, so this reads back and rewrites a cross-node credential); trigger nodes/reload_nginx and nodes/restart_nginx across the cluster (the exact reload/restart action class the fix protected on the single-node path); and add/modify/delete/reorder namespaces.
Proof of concept: with a valid JWT but no fresh secure session, call POST /api/nodes (AddNode) or POST /api/nodes/reload_nginx. The nginx equivalent POST /api/nginx/reload returns the secure-session challenge; the cluster route succeeds.
## Verification
Source-verified at HEAD: the nginx router wraps reload/restart in RequireSecureSession, the cluster router registers node/namespace/reload/restart directly on the group with no such wrapper, and both mount on the AuthRequired+Proxy-only group. I did not stand up a live nginx-ui.
## Suggested fix
Wrap the cluster router's mutation handlers (node CRUD, nodes/reload_nginx, nodes/restart_nginx, namespace CRUD) in middleware.RequireSecureSession(), mirroring api/nginx/router.go. Secondary lower-confidence items worth checking in the same pass: the system/restart handler, the core-upgrade websocket, and the upstream socket PUT also appear to run without the step-up (I did not fully trace these).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 have a vulnerability where StaxUtils does not limit the total number of XML elements or characters by default. This can lead to excessive memory and CPU usage during XML parsing, potentially causing a denial of service. The issue is fixed by introducing default limits on element count and document size in the specified versions.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 contain a vulnerability in the Netty-based HTTP client transport where the hostname in the server's TLS certificate is not verified against the host being called. This flaw affects both HTTP/1.1 and HTTP/2 connections and allows a network attacker who can intercept traffic to impersonate the target service by presenting any trusted certificate. This can lead to reading or modification of exchanged messages, including credentials. Upgrading to fixed versions is recommended.
Apache CXF contains a vulnerability in its multipart/MTOM attachment part header parser where configured limits on header size and count are not fully enforced. This allows a remote unauthenticated attacker to send specially crafted multipart requests with very large folded or repeated headers, causing unbounded memory allocation and resulting in a denial of service. Versions prior to 4.2.4, 4.1.9, and 3.6.13 are affected. Upgrading to these fixed versions mitigates the issue.
CVE-2026-100227 is a high-severity vulnerability in Apache CXF's JAX-RS XML Security module involving improper verification of cryptographic signatures. The affected XML Signature interceptors did not ensure that the XML content passed to the application was fully covered by the signature, allowing an attacker to wrap a signed document inside unsigned content that the application would mistakenly treat as signed. This issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
Apache CXF contains a vulnerability in the STSTokenValidator component where the validation result of a SAML assertion signed by a trusted certificate is stored in a shared object accessible by all requests. This allows a remote, unauthenticated attacker to send a forged assertion signed with an untrusted certificate that could be mistakenly accepted as trusted during concurrent request processing. The issue affects services using STSTokenValidator without the alwaysValidateToSts setting enabled. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address this vulnerability.