The Forminator Forms WordPress plugin up to version 1.57.3.1 contains an Insecure Direct Object Reference (IDOR) vulnerability via the 'previous_draft_id' parameter. This flaw allows unauthenticated attackers who have obtained a victim's draft ID (e.g., from a shared 'continue later' link) to delete and overwrite saved drafts belonging to other users. The nonce intended to protect this action is publicly accessible and does not prevent exploitation.
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.17.10. This flaw arises from insufficient input sanitization and output escaping of the inbound email body. An unauthenticated attacker can exploit this by injecting arbitrary web scripts that execute when a user views the affected page. The vulnerability is facilitated by the inbound email router relying solely on a regex match for a reply token in the References header, without cryptographic validation, allowing external parties to bypass authentication checks.
The Meow Gallery plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.5.1. This flaw arises from insufficient sanitization and escaping of the attachment alt text used in the aria-label attribute. Authenticated users with author-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability requires that gallery items are rendered as links and exploits how WordPress sanitizes text fields, allowing injection of event-handler attributes.
The Meow Gallery plugin for WordPress up to and including version 5.5.4 has an authorization bypass vulnerability. This flaw allows authenticated users with author-level access or higher to enumerate and read metadata of all private and draft posts on the site, including those authored by other users. The metadata exposed includes post ID, title, date, author, and status.
A vulnerability in the gettext family of functions in GNU C Library 2.0 and later allows attackers to exploit the LANGUAGE environment variable to load message catalogs from arbitrary filesystem locations. This can lead to program crashes or arbitrary code execution if a crafted .mo file is used. The issue arises because LANGUAGE entries containing '/' or '..' are accepted unless the program is setuid or setgid (AT_SECURE). Exploitation requires the attacker to control the environment and place malicious files in readable locations, and to select a locale other than "C", "C.<encoding>", or "POSIX".
CVE-2026-69446 is an incorrect authorization vulnerability in Microsoft Edge (Chromium-based) that allows an authorized local attacker to elevate their privileges. The flaw impacts confidentiality and integrity but does not affect availability. The vulnerability has a medium severity rating with a CVSS score of 4.4.
The NextGEN Gallery plugin for WordPress up to version 4.4.1 contains a remote code execution vulnerability via the legacy_render function. This flaw arises from broken authorization on the Lightroom gallery_edit endpoint, allowing authenticated users with custom-level access or higher who own at least one gallery to upload files with crafted extensions that bypass checks. This enables execution of arbitrary code on the server.
Mythic versions 3.2.16 through 3.4.0.61 have a stored cross-site scripting (XSS) vulnerability. Attackers who control target endpoint files can embed malicious HTML in files named with a .pdf extension. When an operator previews such a file in the Mythic UI, the malicious content executes JavaScript in the same origin, allowing theft of localStorage JWT tokens. These tokens grant full GraphQL and REST API access.
A missing authorization vulnerability in changelog.com before commit 7b35e829 allows unauthenticated attackers to access unpublished content. The flaw affects preview routes in PostController, NewsIssueController, and NewsItemController, enabling attackers to read draft posts, unsent newsletters, and declined news items by enumerating identifiers.
Flowise versions through 3.1.4 have a sandbox escape vulnerability that allows authenticated users to execute arbitrary OS commands. This occurs when the ALLOW_BUILTIN_DEP=true setting is enabled, enabling abuse of allowlisted langchain and mammoth modules. Attackers can submit JavaScript code to the /api/v1/node-custom-function endpoint, which writes a file into the mammoth package via LocalFileStore and requires it, thereby escaping the vm2 sandbox as the Flowise process user.
The Majestic Support WordPress plugin up to version 1.2.2 contains a SQL Injection vulnerability via the 'columns (array keys)' parameter. Authenticated users with subscriber-level access can exploit this flaw to append SQL queries and extract sensitive database information. The vulnerability arises from insufficient escaping and preparation of user input in SQL queries. Exploitation requires the attacker to obtain a nonce from their own 'Add erase request' page, which is legitimately accessible to subscribers.
CVE-2026-119620 is a high-severity vulnerability in the cak-filemanagement-system affecting the move_uploaded_file function in admin/add_logs.php. It allows an attacker to perform unrestricted file uploads by manipulating the File argument remotely. The vulnerability has been publicly disclosed, but the project has not yet responded or issued a fix.
sniproxy versions through 0.7.0 have a NULL pointer dereference vulnerability in the resolv_cancel() function. This flaw allows remote unauthenticated attackers to crash the sniproxy daemon by sending overlong hostnames, specifically TLS SNI names or HTTP Host headers of 254 or 255 characters that match a wildcard backend, then closing the connection to terminate the proxy process.
Axigen Mail Server WebMail versions before 10.6.39 and 10.7.1 have a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated remote attackers to inject malicious scripts via unescaped sender display names in the conversation view. When a recipient opens the affected folder, the injected script executes, potentially leading to mailbox content theft or redirection.
Axigen Mail Server versions before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 have an unauthenticated denial of service vulnerability. This flaw is due to unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. An attacker can send a single deeply nested request to various web service listeners, causing stack exhaustion and repeated crashes of SMTP, IMAP, POP3, and web services.
The Essential Addons for Elementor WordPress plugin up to version 6.8.7 contains a privilege escalation vulnerability via the page_id parameter in the register_user() function. This flaw allows unauthenticated attackers to register accounts with elevated roles such as Editor by exploiting how WordPress revision post statuses and author checks are handled, combined with a publicly accessible nonce endpoint. Exploitation requires that the site permits user registration and that an administrator has previously saved and reverted a non-default user role on a page using the Login/Register widget.
A vulnerability in GStreamer's gst-plugins-bad H.266/VVC parser allows a crafted malformed media file or stream to trigger an integer overflow during parsing of profile, tier, and level fields. This overflow can lead to a stack-based buffer overflow, potentially causing application crashes or enabling code execution with the application's privileges. The flaw affects certain versions of gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 10.2.z, 10.3.z, 10.4, RHIVOS 2.1 and 2.1-core, and Fedora 43. No complete mitigation or fix is currently available, and users are advised to disable H.266/VVC media ingestion or avoid processing untrusted H.266/VVC content until patched.
The GeoDirectory WordPress plugin (including WP Business Directory and Classified Listings Directory) up to version 2.8.199 is vulnerable to stored cross-site scripting (XSS) via the listing description field. This occurs due to insufficient sanitization of input on save combined with unsafe rendering of popover HTML content, allowing authenticated users with Subscriber-level access or higher to inject arbitrary scripts that execute when the affected page is viewed.
LM Studio versions before 0.4.22+1 have a path traversal vulnerability in the model downloader's resolveDownloadRequest function. This flaw allows attackers to write files outside the intended models directory by using backslash-separated traversal filenames. Exploitation can lead to planting malicious files such as plugin manifest.json, install-state.json, and mcp-bridge-config.json, which execute an attacker-supplied Python payload on every application launch.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve a malicious comment containing a crafted shortcode. Once approved, the injected script executes for any visitor interacting with the video player on the affected page.