Mercury, a Python framework for sharing Jupyter notebooks as web applications, contains a critical vulnerability in versions 3.0.0 through 3.2.3. A missing comma in the BLOCKED_PATTERNS regular expression causes concatenation of patterns, allowing requests to /api/terminals to bypass endpoint restrictions. This enables unauthenticated attackers to access Jupyter Server's terminal API and execute arbitrary commands with the privileges of the Mercury process. The issue is fixed in version 3.2.4.
The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
The Salon Booking System WordPress plugin versions before 10.31.11 have an improper access control vulnerability in one of their REST API endpoints. This flaw allows any authenticated user, including low-privileged roles like subscribers, to access all discount coupons configured on the site. The exposed information includes coupons that administrators intended to hide from customers, along with details such as amounts, validity dates, and usage limits.
A vulnerability in the WP User Manager WordPress plugin before version 2.9.20 allows unauthenticated users to create functional accounts without completing payment. This occurs because the plugin does not roll back the WordPress account created during payment-gated registration if the payment step fails.
CVE-2026-61726 is a high-severity improper access control vulnerability in Tandoor Recipes prior to version 2.6.12. It allows authenticated users with read and write API scope within a shared Space to read and modify private recipe steps belonging to other members of the same Space. The flaw arises because the application checks only Space membership rather than recipe-level ownership or sharing permissions when accessing certain API endpoints. This issue does not allow cross-Space access and is fixed in version 2.6.12.
CVE-2026-17073 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper access control due to missing subtree checks during file handle resolution, which could allow a local attacker to obtain sensitive information. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability.
CVE-2026-61610 is an improper access control vulnerability in Lychee, an open-source photo-management tool. Prior to version 7.6.1, when the photos_star_visibility setting is configured to anonymous, unauthenticated attackers can fetch and modify photos without proper authorization checks. This allows attackers to identify private photos by response differences and change their highlight status, even for photos in private or password-protected albums. The vulnerability is limited to installations using the non-default anonymous star-visibility setting. The issue is fixed in version 7.6.1.
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.
Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
CVE-2026-107795 is a high-severity vulnerability in TP-Link Omada Software Controller versions prior to 6.3.0.45. It involves missing authorization checks in the MSP and OpenAPI certificate/private-key management APIs, allowing authenticated users with low privileges to perform privileged certificate management operations. Exploitation could enable such users to upload or delete TLS certificates or private keys, potentially disrupting secure management access.
FileRise versions prior to 3.23.0 contain an improper access control vulnerability in the /api/folder/renameFolder.php endpoint. Authenticated users who are not folder-scoped administrators can move a folder they own into another user's folder or the root namespace without proper authorization checks on the destination. This allows rekeying of ownership and ACLs to the new location. The vulnerability does not allow overwriting existing files and reveals limited information about destination paths through error messages. The issue is fixed in version 3.23.0.
Redash versions from 26.0.0 up to but not including 26.9.0 contain an improper access control vulnerability in the DuckDB query runner. This flaw allows users with query access to an administrator-created DuckDB data source to read or write files on the server with the privileges of the Redash process. Sensitive application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could be exposed, potentially enabling session forgery and authentication bypass. The issue is resolved in version 26.9.0.
CVE-2026-103929 is an OS command injection vulnerability in the jdx mise tool. It arises because certain shell interpreter argument settings in local untrusted .mise.toml files are not properly restricted by the global_only denylist, allowing attackers to control the shell interpreter arguments used for command execution. This enables arbitrary command execution when a user runs trusted or global tasks without explicit shell settings. The vulnerability affects versions prior to 2026.7.14 and has a CVSS score of 7.8 (high severity).
CVE-2026-101301 is a medium severity vulnerability in the WPCode WordPress plugin versions 2.0.0 up to but not including 2.4.0. The plugin fails to properly verify that a request is for the login screen before enabling snippet safe mode, which allows unauthenticated visitors to disable all automatically inserted snippets on the site for their own requests.
A vulnerability in the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before version 5.3.2 allows unauthenticated users to trigger an AJAX action that re-registers the store and overwrites the stored shop secret. This occurs because the plugin does not perform nonce or capability checks on the relevant AJAX action.
CVE-2026-87843 is a vulnerability in the Trust Payments Gateway for WooCommerce WordPress plugin before version 3.1.0. The plugin fails to verify the authenticity of the payment provider's response when a customer returns from the hosted payment page. It also does not bind the response to the targeted order or verify the payment amount. This allows unauthenticated attackers to mark arbitrary orders as paid without actual payment and to access order and customer details.
EmbedPress WordPress plugin versions before 4.6.8 have an improper access control vulnerability. Unauthenticated attackers can trigger server-side requests to third-party APIs using the site owner's credentials and inject attacker-controlled cache entries into the site's database. This can lead to unauthorized consumption of the site owner's third-party API quota and unbounded database record creation.
CVE-2026-110459 is an improper access control vulnerability in Ubiquiti Inc's UniFi Protect AI Key. A malicious actor with network access could exploit this flaw to obtain information, make unauthorized changes, and cause a denial of service (DoS) on the device. The vulnerability affects versions prior to 2.2.8. It has a high severity score of 8.6 and does not require user interaction or privileges to exploit.
CVE-2026-110456 is an improper access control vulnerability in Ubiquiti Inc's UniFi Protect AI Key. A malicious actor with network access could exploit this flaw under certain conditions to access internal resources through the device. The vulnerability affects versions prior to 2.2.8. The CVSS score is 5.3, indicating a medium severity level. There are no known exploits in the wild and no vendor-provided patch information is available at this time.