CVE-2026-97296 is a high-severity vulnerability in Rocketgenius, Inc Gravity Forms that involves deserialization of untrusted data, leading to object injection. This affects Gravity Forms versions from initial releases up to but not including 3.1.1. The vulnerability has a CVSS score of 8.1, indicating a significant risk to confidentiality, integrity, and availability if exploited.
CVE-2026-110366 is a missing authorization vulnerability in Gemini Labs Site Reviews affecting versions prior to 8.3.5. It allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized modification of site reviews. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin versions up to 4.9.3 contain a path traversal vulnerability in the copy_file function. Authenticated users with Sales Representative-level access or higher, who have the import_contacts capability, can delete arbitrary files on the server. This can lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability arises from insufficient file path validation.
The Bulk Page Generator – LPagery WordPress plugin up to version 3.1.0 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can create, modify, and delete pages and bulk page-generation processes without proper authorization checks. On fresh installations without Freemius opted in, the AES-256-CBC key used for Bearer token validation defaults to a publicly known value, making token forgery trivial for any authenticated user.
FluentCart plugin for WordPress versions up to 1.7.0 contains an insecure direct object reference vulnerability. This flaw allows unauthenticated attackers to access other customers' billing and shipping address information by manipulating user-controlled keys in AJAX requests. The vulnerability arises from missing validation on order_id and address_id parameters, enabling enumeration of sequential IDs and bypassing intended access controls. The exposed data includes sensitive personally identifiable information (PII) such as street address, phone number, company name, and VAT number. The vulnerability has a high severity rating with a CVSS score of 7.5.
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress versions up to 5.2.1 contains an authorization bypass vulnerability via the 'password' parameter. Authenticated users with custom-level access or higher can exploit missing validation on a user-controlled key to change the WordPress password of any customer who has placed an order with the attacking vendor. This enables limited account takeover by logging in as that customer. Vendor-level access is required and can be self-registered if the public vendor registration option is enabled.
FluentCart, a WordPress eCommerce plugin, contains an SQL Injection vulnerability in versions up to and including 1.7.0. The flaw arises from improper escaping of user-supplied parameters in SQL queries, allowing authenticated users with custom-level access or higher to append malicious SQL commands. On FluentCart Pro, users with the Manager shop role can exploit this without administrator privileges. The vulnerability has a medium severity with a CVSS score of 4.9 and can lead to unauthorized disclosure of sensitive database information.
CVE-2026-111275 is a medium severity stack-based out-of-bounds read and write vulnerability in the NIFTI-Imaging nifti_clib library up to version 3.0.1. The flaw exists in the nifti_convert_n2hdr2nim() function, where the NIfTI-2 dim[0] value is not range-checked. This allows an attacker to supply a crafted 540-byte NIfTI-2 header via nifti_image_read(), potentially causing application crashes or stack memory corruption.
@casl/ability versions 6.7.5 up to but not including 7.0.2 contain a prototype pollution vulnerability in the rulesToFields() function. This flaw allows attackers who can control rule conditions to modify inherited built-in object properties via specially crafted dotted keys such as 'toString.call'. Exploitation can lead to denial of service of the Node.js process running the affected library.
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
CVE-2026-104828 is a cross-site scripting (XSS) vulnerability in htmlunit-neko, an adaptation of NekoHTML used by HtmlUnit. Versions prior to 5.4.0 improperly handle TEXTAREA and TITLE element content by writing decoded character data without entity encoding. This causes entity references inside these elements to be decoded and emitted as raw markup during parse-and-serialize operations, potentially allowing attacker-controlled encoded text to become executable markup in browsers. The issue is fixed in version 5.4.0.
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.
The `annotation-xml` tag has slightly different behavior than the other "integration point"
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
strip the namespace-incompatible tags.
This vulnerability only has an effect when the `math` and `annotation-xml` tags
are both enabled, but the `encoding` attribute is disabled, because it relies
on the following sequence of steps:
1. User writes code like `<math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>`.
2. Namespace filtering checks the DOM, and it passes. `<gadget>` is parsed as HTML.
3. Attribute filter strips it down to `<math><annotation-xml><gadget></annotation-xml></math>`. Because the encoding attribute is gone, `<gadget>` is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.
Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
These [elements] are:
* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
[elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs
### Impact
Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.
### Patches
- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)
- https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)
- https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)
### Workarounds
Call <code>builder.[add_clean_content_tags](https://docs.rs/ammonia/latest/ammonia/struct.Builder.html#method.add_clean_content_tags)("annotation-xml")</code> to remove the annotation-xml element and all of its children, including the XSS gadget.
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
CVE-2026-102631 is an improper authentication vulnerability in Canonical's authd before version 0.7.1. The flaw occurs because authd resolves user identity by broker-scoped provider ID but falls back to username matching without rejecting conflicting non-empty provider IDs. This can cause a new user to inherit the previous user's local UID and home directory if an identity provider reassigns an email address. Consequently, the new user can access and modify files, including sensitive credentials like SSH keys and cloud API tokens, belonging to the previous user. Administrators are advised to lock or delete the previous user's local authd account when the corresponding identity provider account is removed.
CVE-2026-45452 is a high-severity vulnerability in Unitronics UniStream Pro (B10 and C10 models) and UniLogic software versions prior to 1.41.329. It involves the use of externally-controlled format strings, which can lead to severe impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or cause denial of service.
CVE-2026-45451 is an improper authentication vulnerability affecting Unitronics UniStream Pro (B10/C10) and UniLogic versions prior to 1.41.329. This flaw allows an attacker with limited privileges to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity rating with a CVSS score of 8.3. No official patch or remediation details are provided in the available data.
CVE-2026-45450 is a high-severity vulnerability in Unitronics UniStream Pro (B10 / C10) and UniLogic versions prior to 1.41.329. It involves improper restriction of operations within the bounds of a memory buffer, classified as CWE-119. This flaw could allow an attacker with low privileges and no user interaction to achieve high impact on confidentiality and integrity, and low impact on availability.
CVE-2026-45449 is an OS Command Injection vulnerability in Unitronics UniStream Pro and UniLogic software. It affects Unitronics UniStream Pro versions B10 and C10, and UniLogic versions prior to 1.41.329. This vulnerability allows improper neutralization of special elements used in OS commands, potentially enabling an attacker with limited privileges to execute arbitrary commands. The CVSS score is 8.3, indicating a high severity impact with high confidentiality and integrity impact and low availability impact.
CVE-2026-109693 is an Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC's Fluent CRM plugin. It allows privilege escalation, potentially enabling an attacker with limited privileges to gain higher-level access. The vulnerability affects Fluent CRM versions from initial releases up to 3.2.5. The CVSS 3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.