The Mine CloudVod WordPress plugin versions before 2.6.6 contain an authorization bypass vulnerability. This flaw allows any authenticated user, including subscribers, to access payment status information of other customers' orders without proper ownership verification. Sensitive details exposed include the purchased item and, during Alipay payment processing, the buyer's Alipay account identifier.
TI WooCommerce Wishlist plugin versions before 2.13.0 contain an authorization flaw that allows unauthenticated users to delete items from other users' wishlists if they know or guess the wishlist's share key. This occurs because the plugin does not verify ownership of the wishlist for visitors who are not logged in.
A SQL injection vulnerability exists in the TI WooCommerce Wishlist WordPress plugin versions before 2.0.7. This flaw arises because user input is not properly sanitized and escaped before being used in a SQL statement on a front-end endpoint. The vulnerability allows unauthenticated users to perform SQL injection attacks. The issue is fixed in version 2.0.7.
A privilege escalation vulnerability exists in the WP Remote Users Sync WordPress plugin versions before 2.3.0. The plugin does not properly restrict which user metadata keys can be modified during incoming user synchronization requests. This flaw allows an attacker with access to the shared synchronization keys to escalate any existing user account to administrator privileges.
The ContentPen WordPress plugin versions before 1.1.1 expose their REST API key to unauthenticated users. This exposure allows attackers to create posts containing unfiltered JavaScript, resulting in stored cross-site scripting (XSS) that executes in the browsers of any visitors, including administrators.
The Abilities Bridge WordPress plugin before version 1.4.2 contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows attackers to bypass nonce validation when re-authenticating REST API requests from a logged-in session cookie. Exploitation can lead to an attacker tricking an administrator into performing unauthorized REST API actions, including creating new administrator accounts and taking over the site. The vulnerability is fixed in version 1.4.2.
The AskAny WordPress plugin versions before 2.2.1 contain an authorization bypass vulnerability. This flaw allows unauthenticated users who can obtain or guess another visitor's session identifier to access that visitor's chat transcript and personal details, including name, email address, and IP address. Attackers can also add messages to or overwrite the victim's chat conversation. The issue is fixed in version 2.2.1.
The Defender Security WordPress plugin versions before 6.4.1 have an improper authentication vulnerability where the plugin does not limit the number of failed two-factor authentication attempts by default. This allows an attacker who already knows a user's password to brute-force the one-time code, potentially bypassing the second factor of authentication.
The Defender Security WordPress plugin versions from 4.9.0 up to but not including 6.4.1 contain an authentication bypass vulnerability. This flaw allows unauthenticated attackers to spoof their IP address because the plugin does not verify that the client IP used for firewall and lockout decisions comes from a trusted source. Exploitation enables attackers to evade IP-based protections such as login lockout and IP banning, impersonate allowlisted IP addresses, and poison activity logs. The issue is fixed in version 6.4.1.
A vulnerability in the Directorist WordPress plugin before version 8.11.1 allows users with Subscriber-level accounts or higher to change the status of their own listings from pending to published. This bypasses the intended administrator moderation process.
A SQL injection vulnerability exists in the WP Directory Kit WordPress plugin versions before 1.6.3. The plugin fails to properly sanitize and escape a parameter used for ordering results on an admin screen, relying on a keyword deny-list that can be bypassed. This allows users with the custom Listing Admin role or higher to perform SQL injection attacks.
The Descope WordPress plugin versions before 1.2.0 contain an improper authentication vulnerability. The plugin does not validate authentication tokens before creating WordPress sessions, accepting any non-empty token. This flaw allows an unauthenticated attacker to obtain a session for any existing user account, including administrators, by supplying the target account's email address.
A stored cross-site scripting (XSS) vulnerability exists in the Photo Gallery by 10Web WordPress plugin versions before 1.8.49. The flaw arises because the plugin does not properly escape a shortcode attribute that sets a gallery watermark image, and it decodes percent-encoded characters in this attribute before rendering it into an HTML image attribute. This allows users with Contributor-level access or higher to inject malicious scripts that execute in the browsers of any users who view the published gallery, including administrators.
The Crop Thumbnails WordPress plugin before version 1.10.0 contains an authorization bypass vulnerability. Authenticated users with the upload capability, such as those with the Author role by default, can read and overwrite thumbnail metadata and files of media attachments owned by other users. This occurs because the plugin does not enforce object-level authorization when re-cropping media attachments.
A missing authorization vulnerability in the Oxygen MyData for WooCommerce WordPress plugin versions 3.0.0 through 3.0.8 allows unauthenticated users to mark arbitrary WooCommerce orders as completed via a payment callback. This flaw is fixed in version 3.0.9.
A security vulnerability in GNU Aspell allows arbitrary code execution via a crafted dictionary file. This flaw affects Red Hat Enterprise Linux 9.6 Extended Update Support versions of the aspell package. Red Hat has issued an important security update to address this issue.
CVE-2026-101107 is an OS command injection vulnerability in SoftBank Corp.'s Air Terminal 6. It allows a user with access to the web management console to execute arbitrary commands with root privileges. The vulnerability affects versions from 0 up to and including 1.01.80. It has a high severity with a CVSS score of 8.0, indicating significant impact on confidentiality, integrity, and availability.
The npm package '@rfewqa-fes/mnm-doc-mcp' version 1.0.0 declares a dependency on 'node-health-utils' via an off-registry HTTP tarball URL hosted at a bare IP address. This setup allows the host controlling that IP to execute arbitrary code on any system installing the package, as the tarball is fetched without version pinning, integrity verification, or encryption. The main package itself is inert, but the dependency serves as a delivery mechanism for malicious code.
This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 9.8. The update includes fixes for several security issues such as use-after-free vulnerabilities, denial of service via unvalidated tasks in iSCSI, and privilege requirements for certain network operations. The advisory also includes various bug fixes and enhancements to improve kernel stability and security. Systems must be rebooted after applying the update for changes to take effect.
CVE-2026-111436 is a memory leak vulnerability in the openEuler iSulad daemon affecting versions up to 2.1.6. The flaw occurs in the src/daemon/modules/spec/specs_mount.c file, where memory is not properly released after its effective lifetime. This leads to frequent triggering of the iSulad daemon, exhausting system memory and causing an out-of-memory (OOM) crash, resulting in a denial of service (DoS).