Threats affecting pkg:npm/@byondreal/accessor

An improper locking vulnerability exists in Fortinet FortiOS versions 8.0.0 and 7.6.4 through 7.6.6. This flaw may allow an unauthenticated attacker with network access to cause a denial of service (DoS) on the HTTPS management interface by sending crafted HTTP requests.

The OnCell G3150A-LTE Series devices contain a hard-coded cryptographic key vulnerability. This flaw allows an unauthenticated remote attacker, under certain conditions, to obtain shared cryptographic key material. If the affected devices have not regenerated their cryptographic keys, the attacker could impersonate these devices, potentially compromising the confidentiality and integrity of management communications.

The TiendaCrypto para WooCommerce WordPress plugin versions through 1.2.1 improperly verify payment webhook authenticity by validating signatures against an always-empty key. This flaw allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

An out-of-bounds read vulnerability exists in the QAuthenticator NTLM authentication handling within the Qt Network module. This flaw allows remote attackers to read sensitive heap memory or cause application crashes by sending a crafted NTLM challenge. The issue affects applications using QNetworkAccessManager or QTcpSocket with NTLM authentication.

The PayDunya WooCommerce Payment Gateway WordPress plugin versions through 1.1.6 fails to verify the authenticity of incoming payment notifications properly. This flaw allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed by exploiting the use of an empty secret value for authentication until the gateway is configured.

An unauthenticated SQL injection vulnerability exists in the Gridbox extension for Joomla versions 1.0.0 through 2.20.4.1. The flaw occurs on store product list pages where the sort-by URL parameter is improperly handled, allowing injection into the ORDER BY clause of a SQL query. This vulnerability is critical with a CVSS score of 9.3.

CVE-2026-102789 is a critical improper access control vulnerability in the Gridbox extension for Joomla by balbooa.com. Versions from 1.0.0 up to 2.20.4.1 are affected. The flaw exists because the EditorController::getBlogPosts() task lacks an authorization check that other controller tasks perform, allowing unauthorized users to invoke this function. This could lead to unauthorized access to blog post data or actions within the extension.

CVE-2026-117494 is a high-severity Cross-Site Scripting (XSS) vulnerability in the Sisense Cloud BI Platform. It occurs when SVG images submitted to the /api/v2/ai/sessions API in base64-encoded SVG format contain embedded script tags. These scripts execute when the SVG content is rendered in the assistant window, allowing JavaScript execution and alteration of displayed content.

CVE-2026-117493 is a stored cross-site scripting (XSS) vulnerability in the Sisense Cloud BI Platform affecting BloX widgets. The vulnerability arises because the /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the 'desc' and 'text' parameters, which is then executed in the browser when the widget is rendered. This can lead to compromise of confidentiality of information accessible in that context. The vulnerability has a high severity score of 8.3 and was fixed on 27 October 2026.

CVE-2026-85299 is a missing authorization vulnerability in Google Cloud Compute Engine affecting the disks.createSnapshot and regionDisks.createSnapshot APIs. It allows an authenticated attacker to exfiltrate disk data across projects. The issue was patched on August 31, 2026, and no customer action is required.

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.

CVE-2026-65213 is an OS command injection vulnerability in the SMCI MBD-X12SPI product. It allows an IPMI authenticated administrator to execute arbitrary commands as the operating system root user on the Baseboard Management Controller (BMC). This vulnerability has a medium severity rating with a CVSS score of 6.6. The affected version is exactly 01.07.20. No public exploits or patches are currently reported.

CVE-2026-65211 is an improper authentication vulnerability in the SMCI MBD-X12SPI product. It allows an authenticated IPMI Administrator to read and write arbitrary Baseboard Management Controller (BMC) physical memory, potentially leading to code execution on the BMC operating system. This vulnerability has a high severity with a CVSS score of 7.2.

CVE-2026-65210 is a vulnerability in the SMCI MBD-X12SPI product that allows an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem. This access goes beyond the intended IPMI management role, potentially exposing sensitive information. The vulnerability affects version 01.07.20 of the product. The CVSS score is 4.9, indicating a medium severity level.

CVE-2026-65220 is a high-severity vulnerability in the SMCI MBD-X12SPI product involving a logic flaw in the BMC IPMI implementation. This flaw allows an attacker with limited privileges to send specially crafted RAKP+ messages to escalate their account to administrator privileges. The vulnerability affects version 01.07.20 of the product. No public exploits or known active exploitation have been reported. The CVSS 3.1 score is 8.8, indicating a significant risk due to network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

CVE-2026-65219 is a high-severity vulnerability in the SMCI MBD-X12SPI product affecting version 1.07.20. It involves an incorrect behavior order flaw (CWE-696) in the BMC RAKP+ implementation that may allow an attacker to establish an RMCP+ session by sending a request followed by a specially crafted RAKP message. This session could then be used to execute commands on the affected system.

The npm package @camera.ui/camera-ui-nvr-windows-amd64 version 1.6.1 contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by it.

CVE-2026-18451 is a vulnerability in the SMCI MBD-X12SPI product where the HTML5 KVM-over-IP console uses a predictable seed in its pseudo-random number generator for session token creation. This weakness allows an attacker to potentially guess the session token and gain control of the KVM session. The vulnerability affects version 01.07.20 of the product. The CVSS score is 3.1, indicating a low severity impact with limited confidentiality impact and no integrity or availability impact.

CVE-2026-18450 is a critical vulnerability in SMCI X12SPI where the Baseboard Management Controller (BMC) fails to properly enforce integrity and encryption requirements for IPMI commands. This flaw allows an attacker to craft malicious packets that can execute arbitrary commands on an active session without authentication.

The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'forget_password_link' parameter. This flaw affects all versions up to and including 4.61.0. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.