The npm package tailwindcss-hook-forms impersonates the legitimate @tailwindcss/forms plugin by copying its name, repository, author, README, and changelog. It contains obfuscated malicious code that executes attacker-controlled commands in the Node.js process of any consumer importing the package. This code has full access to require, process, filesystem, and network, posing a significant security risk. The package replicates the public API of the legitimate plugin to avoid detection.
The strutil-helpers-core npm package, which claims to provide lightweight string utility functions, contains malicious native code components that execute attacker-controlled code upon import. It includes large native binaries and an opaque data blob that are unnecessary for its advertised functionality. The package performs sandbox, CI, and debugger detection to evade analysis and then stages and executes hidden JavaScript code on the host system.
blueprintUE Self-Hosted Edition versions before 4.3.6 have an iframe injection vulnerability. Authenticated users can exploit the PeerTube video URL matcher to embed arbitrary third-party content in an unsandboxed iframe after user consent. This can lead to framing of fake login forms or malware downloads.
CVE-2026-126813 is a vulnerability in Roundcube Webmail versions before 1.6.21 and 1.7.x before 1.7.6. It allows attackers to inject IMAP commands via CRLF sequences in the _uid parameter when the messages_cache feature is enabled. This can lead to unauthorized deletion of messages, modification of message flags, or granting mailbox access through the SETACL command. The vulnerability requires a logged-in victim to open a crafted GET link. It has a high severity with a CVSS 4.0 score of 7.4.
blueprintUE Self-Hosted Edition versions prior to 4.3.7 have an insecure default Docker Compose configuration that enables an empty root password for the MariaDB database. This allows unauthenticated attackers who can access the Docker host on port 3306 to log in as root without a password and fully control the database contents, including user accounts and blueprints.
BookStack versions prior to 26.09.3 have an authorization vulnerability allowing authenticated users to access or modify other users' unpublished draft page images. The flaw arises because the system checks only PageView permission without verifying draft status, enabling unauthorized read or tampering actions on draft images via sequential IDs.
WWBN AVideo versions 29.1.0 through 29.7.1 have a stored cross-site scripting (XSS) vulnerability in the channel About field. Registered users can inject malicious markup that bypasses filtering and executes when any visitor views the channel feed. This can lead to script execution in the context of the affected site.
CVE-2026-126809 is a missing authorization vulnerability in WWBN AVideo versions up to 29.7.1. It affects the objects/import.json.php endpoint, allowing authenticated uploaders to import MP4 files from other users by referencing any folder under videos/. This enables attackers to copy private, unlisted, password-protected, or pay-per-view videos, read associated .txt or .html description files, list files via objects/listFiles.json.php, and delete media using the delete parameter.
CVE-2026-126808 is an authorization vulnerability in weDevs ERP (WP ERP) versions up to 1.17.11. Authenticated employees can improperly edit their own HR records due to incorrect permission checks in HRM AJAX handlers. This flaw allows modification of sensitive job-related information such as designation, reporting manager, pay rate, employment type, and deletion of job history.
CVE-2026-126807 is a vulnerability in asternic wuzapi versions up to 1.1.0 that allows authenticated users to bypass authorization controls and access chat metadata belonging to other tenants. This occurs through the GetHistory handler, where a crafted request can expose internal user IDs, stored chat JIDs, and last-message timestamps across tenants. The vulnerability results in cross-tenant information disclosure.
CVE-2026-126806 is a critical stored cross-site scripting (XSS) vulnerability in WWBN AVideo versions 14.3 through 29.7.1. It allows uploaders to inject malicious scripts via the videoDownloadedLink parameter, which is stored unescaped. This script executes in administrator sessions when rendered in the video management interface, potentially enabling attackers to install malicious PHP plugins.
CVE-2026-126805 is an incorrect authorization vulnerability in WWBN AVideo up to version 29.7.1. It allows delegated Videos Admin users to retrieve video_id_hash values for videos owned by any user, including administrators, via encoder endpoints. An attacker can use these hashes to perform password-less logins with elevated privileges, gaining access to plugin upload, configuration, and user management features.
CVE-2026-126804 is a path traversal vulnerability in WWBN AVideo versions 12.4 through 29.7.1. It exists in the ADs plugin's deleteImage.json.php script, allowing authenticated users with custom ads to delete arbitrary files by manipulating the is_regular_user parameter. This can lead to deletion of other users' ads or critical files such as videos/configuration.php, potentially taking the site offline and exposing the installer again.
Rote versions up to 2.6.0 have a privilege escalation vulnerability allowing authenticated admin users to gain super_admin rights by accessing or modifying JWT signing secrets via the /v2/api/admin/settings endpoint. This enables attackers to forge HS256 tokens for the super administrator, change user roles, and escalate privileges.
NextScan versions 1.1.0 through 1.2.0 contain hardcoded HTTP Basic Authentication credentials in specific routers, allowing unauthenticated attackers to access protected APIs. Exploitation enables attackers to retrieve sensitive configuration data such as Redis passwords, etcd details, and server tokens, and to impersonate scan nodes by interacting with registration, heartbeat, and logging endpoints.
Rote versions 1.2.0 through 2.6.0 have an authorization bypass vulnerability in the OAuth bind/merge endpoint. This flaw allows authenticated users to merge any OAuth-bound account into their own by submitting a public existingUserId along with a GitHub or Apple user ID. Successful exploitation enables attackers to take over notes, attachments, API keys, and delete the victim's account.
CVE-2026-126800 is a stored cross-site scripting (XSS) vulnerability in the @hydrooj/ui-default package before version 4.59.1. It allows registered users to inject malicious scripts by placing double quotes in language-class tokens within markdown-it-xss.ts. The injected script can be stored in user profile bios and executes when viewed by administrators or other users, enabling theft of non-httpOnly sid session cookies and potential session hijacking.
Gotenberg versions 8.31.0 through 8.37.x contain a server-side request forgery (SSRF) vulnerability in the IsPublicIP() function. This flaw allows unauthenticated attackers to bypass private IP deny-list protections by exploiting IPv6 zone identifiers appended to certain URLs. By appending a zone such as %25eth0 to unspecified or blocked IPv6 addresses in downloadFrom, webhook, or Chromium/LibreOffice URLs, attackers can access internal services and extract data included in generated PDFs. The vulnerability is fixed in version 8.38.0.
NextScan versions 1.1.0 through 1.2.0 contain a stored cross-site scripting (XSS) vulnerability in the ns-admin URL asset detail dialog. The vulnerability arises because the application renders crawled form request bodies using innerHTML without proper encoding. This allows attackers to inject JavaScript that executes when users view asset details, potentially stealing localStorage access tokens and hijacking user sessions, including those of administrators.
NextScan versions 1.1.0 through 1.2.0 have an authentication bypass vulnerability due to a hardcoded JWT signing key. This flaw allows unauthenticated attackers to forge administrator tokens, granting full access to sensitive administrative functions including user management, scan tasks, and stored vulnerability results.