CVE-2026-101890 is a stored cross-site scripting (XSS) vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows attackers to inject arbitrary JavaScript code via an unescaped site_title value in a package's footprint.json file. The malicious script executes in an administrator's browser when viewing the Prime Mover Packages list, without requiring package restoration.
CVE-2026-42528 is a medium severity vulnerability in Apache HTTP Server up to version 2.4.68. It is caused by a memory allocation bug in the mod_dav module that allows an attacker with permission to create WebDAV locks to crash server child processes. The vulnerability is fixed in version 2.4.69.
Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further.
What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.
This has been patched in 16.3.8.
CVE-2026-102504 affects Imager for Perl versions before 1.037. The vulnerability arises from improper handling of the raw_datachannels value in the i_readraw_wiol function, which lacks range checking. This can cause the program to request an excessive memory allocation, leading to process termination via an uncatchable exit call when allocation fails.
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
Insertion of sensitive information into log file vulnerability in Apache APISIX.
This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure.
This issue affects Apache APISIX: 3.17.0.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
A vulnerability in the PHP SOAP XML parser allows unauthenticated attackers to cause unbounded recursion in the cleanup_xml_node function by sending SOAP requests with deeply nested XML elements. This can exhaust the stack and crash the SoapServer process. The issue also affects the SOAP value decoder and WSDL node search helper. Fixed versions are available.
The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to a reflected DOM-based cross-site scripting (XSS) attack via a parameter that matches the form's url.<name> predefined value. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted form to have a Text Area field configured with a 'url.<name>' predefined value and predefinedClick disabled, which is a common plugin feature.
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber's permanent raw authentication cookie, which they can then use to export the subscriber's full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber's stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site's relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy set — can replay it indefinitely to obtain the victim's credential.
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemName value through the /config?action=set web configuration API. Attackers can exploit this flaw when device authentication is disabled to persistently execute arbitrary script in the browser of any administrator who opens the web management interface, enabling theft of stored secrets such as web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials, as well as hijacking of the authenticated session.
GitPython versions up to 1.2.0.post0_15 contain a vulnerability in the TagReference.create() method where a positional 'reference' argument can bypass the unsafe option guard for '--file'. This allows an attacker controlling the 'reference' parameter to cause an arbitrary local file read, with the file contents returned as the annotated tag message. The issue is an incomplete fix of a prior vulnerability and requires the embedding application to forward a user-controlled 'reference' value. A fix is available in version 1.2.0.post0_15.
CVE-2026-102109 is a SQL injection vulnerability in Kiteworks Secure Data Forms. It occurs when a value derived from an authenticated user's stored account data is used in a database query without proper sanitization. Exploitation requires an authenticated session and only affects deployments using a specific optional feature. The vulnerability affects versions prior to 9.5.1.
CVE-2026-102111 is a vulnerability in Kiteworks Core where the software does not enforce the maximum allowed value for a configurable security-policy setting. An authenticated administrator can set this value beyond its intended range, causing the associated security control to never activate. Despite this, the control appears enabled in the administrative interface and audit logs, effectively rendering it silently ineffective.
A vulnerability in apcupsd through version 3.14.14 causes uninitialized stack memory disclosure in the getupsvar() function within src/cgi/upsfetch.c. This affects CGI scripts such as upsstats.cgi, multimon.cgi, and upsfstats.cgi. When a STATUS line has fewer than three whitespace-separated tokens, sscanf does not assign a value to the destination buffer, but the function returns success, leading to uninitialized memory being printed in the HTTP response. The CVSS score is 3.7, indicating a medium severity issue.
CVE-2026-55174 is a medium severity vulnerability in the shrec UltrafastSecp256k1 library prior to version 4.2.0. The issue involves insufficient verification of data authenticity in the ECDSA adaptor pre-signature verification process, where forged adaptor pre-signatures with an "r" value not cryptographically bound to the adaptor point "T" can be accepted. This flaw has been addressed in version 4.2.0.