The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.
The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.
Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Red Hat has issued a security advisory for util-linux packages addressing three vulnerabilities: a heap use-after-free in libblkid nested partition probing (CVE-2026-13595), a time-of-check to time-of-use (TOCTOU) race condition in the mount program via ancestor directory swap (CVE-2026-53613), and an integer overflow in the DOS partition parser leading to partition metadata compromise (CVE-2026-53615). These utilities are critical low-level system tools necessary for Linux system functionality. The advisory rates the update as important and provides fixes for Red Hat Enterprise Linux 8 and related products. Users are advised to apply the update as detailed in the Red Hat advisory.
OAuth 1 rebinding vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.22.0.
Users are recommended to upgrade to version 1.22.1, which fixes the issue.
CVE-2026-124590 is an improper authorization vulnerability in the zhangbw409 library_manager_system affecting the BookController.addBook function. The flaw arises from manipulation of user-related arguments (userName, userPwd, userEmail, userId) allowing unauthorized access. The vulnerability can be exploited remotely and public exploit details are available. The product uses a rolling release model, so no specific affected versions or patches are identified yet.
In August 2026, Frontline Education experienced a data breach affecting over 3 million school district staff and students. The attackers exploited a vulnerability in a third-party software product to gain unauthorized access. Personal information compromised includes names, Social Security numbers, dates of birth, government ID numbers, health insurance data, and student IDs. The breach was detected on August 14 and contained by August 15. Affected individuals are offered credit monitoring and identity theft protection services.
This is a behavioral detection engine designed to identify Living-off-the-Land Binaries (LOLBins) abuse on Windows endpoints. It uses process telemetry, sequential event correlation, PE masquerading checks, and command-line obfuscation heuristics to detect suspicious activity involving legitimate Windows utilities often exploited by attackers. The engine includes a modular pipeline, a local web dashboard for triage, and automated incident reporting. It aims to overcome limitations of signature-based detection by focusing on behavioral patterns and multi-stage attack chains.
Jupyterlab's nbconvert component versions up to 7.17.0 have a Cross-site Scripting (XSS) vulnerability due to unsanitized rendering of `text/vnd.mermaid` output in HTML exports. This allows injection of arbitrary HTML/JavaScript by breaking out of a <pre> tag in the exported HTML, potentially executing scripts in the context of users viewing the export.
CVE-2026-82436 is a deserialization vulnerability in Apache Storm Client versions 3.0.0 up to but not including 3.1.0. The DefaultStateSerializer used Kryo without class registration and allowed deserialization of untrusted data from the Redis-backed state store. An attacker with write access to the state store keyspace could execute arbitrary code in the worker JVM during state restoration. This vulnerability requires the Redis-backed state provider and write access to the state store, which is a data-plane privilege. The issue is fixed in version 3.1.0, which enforces registered classes during deserialization. Users unable to upgrade immediately should restrict network and credential access to the state store.
Apache Storm Nimbus versions 3.0.0 up to but not including 3.1.0 have a reflection injection vulnerability due to an unset allowlist for topology scheduler strategies. This allows an authenticated submitter to cause Nimbus to instantiate any class on its classpath with a no-argument constructor, potentially leading to resource exhaustion by starting unwanted threads and sockets. The issue is fixed in version 3.1.0 by changing the default behavior to restrict instantiation to Storm's shipped strategies unless explicitly allowed.
CVE-2026-124589 is a path traversal vulnerability in the lxtGH OMG-Seg project affecting the function load_state_dict_into_model in the MoE Shard Checkpoint Loader component. The vulnerability arises from manipulation of the weight_map argument, allowing remote attackers to perform path traversal. The project does not use versioning, so affected versions cannot be precisely identified. Public exploit code is available. No patch or vendor response has been reported yet.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.4.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Stored XSS.This issue affects Motors: from n/a through 1.4.128.