A Server-Side Request Forgery (SSRF) vulnerability exists in the Apache Camel A2A component versions from 4.21.0 before 4.22.2. The issue arises from inconsistent classification of webhook host addresses, allowing an attacker-controlled webhook URL to cause the Camel process to make blind outbound HTTPS requests to internal IPv6 unique local addresses (fc00::/7). This could lead to unauthorized internal network access with medium severity impact. The vulnerability is fixed in Apache Camel versions 4.22.2 and 4.23.0.
WebToffee Product Import Export for WooCommerce versions 2.5.1 up to but not including 2.6.8 contains a server-side request forgery (SSRF) vulnerability. This flaw exists in the download_remote_file function and allows users with shop_manager privileges to submit a CSV URL that triggers an HTTP 302 redirect to internal network addresses. The server then fetches internal responses and returns them as import data, potentially exposing internal services.
A Missing Authorization vulnerability exists in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce versions up to 1.0.10. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity and availability of the affected system.
Apache Qpid Proton C versions through 0.40.0 have a vulnerability in the SASL authentication frame dispatching process. The software incorrectly dispatches AMQP frames that claim to be SASL frames, allowing an authentication bypass. However, no user name is set during this bypass, so the impact depends on how the application handles an unauthenticated state. The issue is fixed in version 0.41.1.
A Missing Authorization vulnerability exists in ThimPress LearnPress up to version 4.4.11. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive data. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable conditions without requiring privileges or user interaction. No patch or remediation information is currently provided.
A SQL Injection vulnerability exists in BuddyPress up to version 14.5.2. This flaw allows an attacker with low privileges to perform blind SQL injection attacks, potentially leading to high confidentiality impact and limited availability impact without requiring user interaction.
A Missing Authorization vulnerability exists in VideoWhisper.com Broadcast Live Video integration up to version 7.3.9. This flaw involves incorrectly configured access control security levels, potentially allowing unauthorized actions. The vulnerability has a CVSS score of 7.1, indicating high severity. No patch or remediation information is currently provided.
A reflected Cross-site Scripting (XSS) vulnerability exists in WP Swings Upsell Order Bump Offer for WooCommerce through version 3.1.6. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected website.
A stack read overflow vulnerability exists in Apache Qpid Proton C versions through 0.40.0 due to a misconfigured wildcard TLS certificate. The flaw does not affect wildcard certificates compliant with the RFC9525 standard. The issue is resolved in version 0.41.1, which restricts accepted certificates to those compliant with RFC9525.
A vulnerability in Apache Qpid Proton C through version 0.40.0 allows a deeply nested message body decoded by pn_message_body() to overflow the stack and cause a crash. The issue is fixed in version 0.41.1.
A signature verification vulnerability exists in the update installation process due to inconsistent validation of update bundle contents. An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but executes an unsigned script with root privileges. This allows the attacker to read or modify sensitive data, alter appliance configuration, or shut down the appliance.
A reflected Cross-site Scripting (XSS) vulnerability exists in OceanWP through version 4.2.7. This vulnerability involves improper neutralization of input during web page generation, which can allow an attacker to inject malicious scripts that execute in the context of a victim's browser.
A vulnerability in Apache Qpid Proton C's OpenSSL TLS implementation causes the APIs pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() to add to rather than replace the default system trust anchors. This behavior can lead to trusting unexpected peer certificates. The issue does not affect the Win32 SChannel TLS implementation. It affects versions through 0.40.0 and is fixed in version 0.41.1.
A reflected Cross-site Scripting (XSS) vulnerability exists in PluginUs.Net TableOn posts-table-filterable component. This vulnerability affects versions up to and including 1.0.7. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected application.
Two OS command injection vulnerabilities exist in the update installation functionality due to insufficient validation of update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that executes arbitrary commands with root privileges. This allows reading or modifying sensitive data, changing appliance configuration, or shutting down the appliance.
An authentication bypass vulnerability exists in myCred up to version 4.0.1 that allows identity spoofing. This flaw could enable an attacker with some privileges to bypass authentication controls, potentially leading to limited integrity impact without affecting confidentiality or availability.
A critical SQL Injection vulnerability (CVE-2026-115964) exists in StylemixThemes Motors plugin up to version 1.4.126. This vulnerability allows an unauthenticated attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and partial denial of service.
OmniRoute versions 3.8.0 up to but not including 3.8.52 have a vulnerability allowing holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without knowing the current password. This can enable attackers to lock out legitimate operators, take over dashboard login, or disable login requirements.
A weak authentication vulnerability exists in the 'Login with phone number' component of Hamid Alinia Login, affecting versions up to 1.8.78. This flaw allows authentication abuse, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 (CVSS 3.1) and requires low privileges to exploit without user interaction.
A missing authorization vulnerability exists in the GEO my WordPress plugin (geo-my-wp) up to version 4.5.5.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable conditions without user interaction and resulting in high confidentiality impact but no integrity or availability impact.