CVE-2026-84231 is a cross-site scripting (XSS) vulnerability in Apache Wicket versions 8.0.0 through 8.19.0. It arises from improper neutralization of input when generating JavaScript click handlers for ExternalLink components bound to non-anchor markup tags. The URL model value is concatenated into JavaScript without proper escaping, allowing an attacker to inject script code that executes in the user's browser when the element is activated. The issue is fixed in Apache Wicket 8.20.0.
CVE-2026-83594 is a high-severity vulnerability in Apache Wicket affecting versions 9.14.0 through 9.24.0 and 10.0.0 through 10.11.0. It involves memory allocation with an excessive size value in the FileUploadToResourceField component, which can be exploited by sending crafted requests that cause the server to allocate large byte arrays, potentially exhausting heap memory. The vulnerability arises because the callback handling uploaded file metadata trusts client-supplied size values without validation. The issue is fixed in Apache Wicket versions 9.25.0 and 10.12.0.
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
WebDyne versions from 2.014 up to but not including 3.022 contain a cross-site scripting (XSS) vulnerability. This occurs because certain form tags (textfield, password_field, filefield) reflect request parameters into their value attributes without proper escaping. The default escaping control (WEBDYNE_CGI_AUTOESCAPE) is off, and from version 2.022 the entity encoding method was replaced with a no-op, rendering escaping ineffective. An attacker can inject malicious scripts via crafted links using these tags.
VOLTA is a sophisticated Windows infostealer malware that uses AI-powered victim profiling to prioritize targets based on their monetization potential. It harvests credentials, browser data, cryptocurrency wallets, sessions from various platforms, and personal information. The stolen data is compiled into a structured evidence bundle and analyzed by large language models (LLMs) such as Claude Opus via OpenRouter, which rank stolen assets by value and assess victim security posture. VOLTA also performs live enrichment by accessing victim accounts on Gmail, Uber Eats, DoorDash, Discord, and Roblox using stolen tokens. The malware self-deletes after execution and operates through third-party infrastructure without actor-owned servers, indicating a builder-based distribution model allowing customized deployments.
VOLTA-AUTODOXER is a self-deleting Windows infostealer that uses AI to prioritize stolen victim data by monetization value. After harvesting credentials, sessions, wallets, and other sensitive data, it builds a detailed evidence bundle about the victim, enriched via stolen session access. This bundle is sent to an LLM via OpenRouter, which acts as an intelligence analyst to rank the victim's assets and assess their security posture. The malware uses a multi-model fallback approach to ensure the AI completes the assessment despite model refusals. VOLTA operates as a builder model, allowing customers to compile customized binaries with their own API keys. There is no attacker-owned infrastructure, and exfiltration occurs in multiple stages. The AI integration represents a novel approach in malware by automating victim profiling and prioritization.
CVE-2026-119196 is a high-severity vulnerability in pyasn1 (up to version 0.6.4) used by smbclient-ng (>=3.1.0). It causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential denial of service via CPU exhaustion. This occurs because the decoder repeatedly shifts and copies the accumulated value for each fragment. The vulnerability affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported.
CVE-2026-119208 is a vulnerability in pypdf (pdfalyzer) that allows an attacker to craft an encrypted PDF file with a manipulated /Count value, causing excessive runtimes and large memory usage when accessing the page count. This can lead to denial of service conditions due to resource exhaustion. The issue affects versions starting from 1.16.1 and has been fixed in pypdf version 6.21.3.
The Welcart e-Commerce plugin for WordPress versions up to and including 2.12.5 is vulnerable to stored cross-site scripting (XSS) via the 'gid' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The attack involves forging a ROBOT PAYMENT browser-return request to store a malicious 'gid' value in order metadata, which executes when an administrator views the order in the WordPress admin panel.
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This bypass is triggered when an attacker supplies a matching field:<key> URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.
The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is due to the plugin extracting the HTML meta description from each remotely-fetched article (WPCP_Readability::parse_meta()), piping that value through the article template substitution and html_entity_decode() in WPCP_Module::insert_post(), and then calling wp_insert_post() after switching the current user to the configured campaign author (an Administrator with the unfiltered_html capability by default) — so no wp_kses_post sanitization is applied to the attacker-controlled HTML before it is persisted as post_content and rendered on the front end. This makes it possible for unauthenticated attackers who control the content of any RSS source an administrator has configured a Content Pilot RSS campaign to consume to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not an effective security barrier because the wpuf_nonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker.
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.