The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
GiveWP WordPress plugin versions before 4.19.0.1 allow unauthenticated users to view unpublished donation forms. This occurs because the plugin does not check user status or capabilities when rendering donation forms on public front-end routes, exposing draft, pending, private, and scheduled forms that WordPress core normally restricts.
WP Stripe Checkout versions before 1.2.2.62 do not verify Stripe webhook signatures when no signing secret is configured, which is the default setting. This improper authentication allows unauthenticated attackers to forge payment completion notifications and create completed orders without actual payment.
A Cross-Site Scripting (XSS) vulnerability exists in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The plugin fails to properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can be exploited to cross privilege boundaries when administrators lack the unfiltered_html capability.
The Chikkili- Google Pay India for Woocommerce WordPress plugin up to version 1.0.6 contains a missing authorization vulnerability. It fails to verify that payment notifications originate from the legitimate payment provider before marking orders as paid. This flaw allows unauthenticated attackers to mark arbitrary orders as paid without making any actual payment.
CVE-2026-116044 is a medium severity vulnerability in prasathmani TinyFileManager up to version 2.6. It involves an unrestricted file upload issue in the Remote URL File Upload Module within tinyfilemanager.php. This vulnerability allows remote attackers to upload files without restrictions. The exploit has been publicly disclosed, but there is no indication of active exploitation in the wild. The vendor has not responded to the disclosure, and no patch or official fix is currently available.
The URL https://pastebin.com/raw/QGrjKCsR was observed in the wild as part of attacker activity on 2026-10-25. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation purposes. The activity was detected by OffSeq Mirage honeypot sensors and originated from attacker infrastructure in Great Britain. There are no known exploits actively using this URL, and no specific affected software versions have been identified.
A vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.09 affects the SMS Code Verification component, specifically the SmsCodeServiceImpl.validateSmsCode0 function. This flaw allows improper restriction of excessive authentication attempts, potentially enabling attackers to bypass rate limiting on SMS code validation. The attack requires high complexity and no privileges, with no user interaction needed. Exploit code has been published, but exploitation is considered difficult. The vendor has not responded to the disclosure. The CVSS score is 3.7, indicating low severity.
A vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.09 affects the SMS Code Verification component in the AuthController.java file. Improper handling of the mobile/code arguments leads to improper authentication, allowing remote attackers to exploit this flaw. The vulnerability has a CVSS score of 7.3, indicating a medium severity. The vendor has not responded to disclosure requests, and no patch or remediation guidance is currently available. Public exploit code exists but there are no confirmed reports of exploitation in the wild.
CVE-2026-85228 is an integer overflow vulnerability in the tensor buffer validation component of the Deep Java Library. The vulnerability could potentially lead to incorrect validation of tensor buffer sizes. No affected versions or detailed technical information are provided. There is no information about available patches or exploits in the wild.
CVE-2026-89090 is a denial of service vulnerability in the event stream header decoder of AWS SDK for Go v2 versions prior to 2026-03-23. An unauthenticated remote actor can send a crafted event stream response frame with an invalid header value type, causing the application process to panic and terminate. The issue is fixed in version 2026-03-23 and later.
CVE-2026-18061 is an XML External Entity (XXE) vulnerability in the AWS Advanced JDBC Wrapper's optional RemoteQueryCachePlugin. This plugin, when enabled with a shared cache, allows an attacker with write access to insert malicious XML into cached column values. When the application reads these cached results as XML, external entities are resolved, potentially exposing sensitive files accessible to the application process, including database and IAM role credentials. The vulnerability affects versions from 3.3.0 through 4.2.0 and is fixed in version 4.3.0. The plugin is not enabled by default. Mitigation includes disabling the plugin or restricting write access to the shared cache.
Two vulnerabilities were found in the open-source tool projen affecting versions before 0.101.37 and 0.103.0. CVE-2026-89065 is a relative path traversal vulnerability that may allow deletion of files outside the project directory. CVE-2026-89066 is an OS command injection vulnerability that could enable arbitrary command execution on developer workstations or CI runners. Fixes are available in versions 0.101.37 and 0.103.0 respectively. Users should upgrade and re-synthesize projects for CVE-2026-89066 to ensure safe task definitions.
CVE-2026-89049 is a server-side request forgery (SSRF) vulnerability in the AWS Systems Manager Agent's Session Manager port forwarding feature. An authenticated user with port-forwarding permission can bypass the remote destination denylist due to improper validation of equivalent address representations. This allows the user to reach link-local endpoints and potentially obtain the managed instance's temporary IAM role credentials, enabling actions with those permissions from outside the instance. The vulnerability affects all versions prior to 3.3.4851.0. AWS has released version 3.3.4851.0 to fix this issue. Until upgrading, it is recommended to restrict the use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping IAM permissions.
CVE-2026-87911 is a reported vulnerability with minimal publicly available information. No technical details, affected versions, or patch information have been provided. There is no evidence of exploitation in the wild at this time.
CVE-2026-87912 and CVE-2026-87913 refer to missing S3 bucket ownership verification vulnerabilities in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server. The vulnerabilities relate to improper validation of S3 bucket ownership, which could potentially lead to security issues. No specific affected versions or detailed technical information are provided. No known exploits are reported in the wild. No patch or remediation information is available at this time.
CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.
CVE-2026-85788 is identified as a vulnerability related to the awslabs mysql-mcp-server. No detailed technical information, affected versions, or patch status is provided in the available data.
CVE-2026-85787 is a vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server versions prior to 1.1.7. It allows an unauthenticated actor to modify data beyond the intended read-only scope by injecting crafted SQL through content submitted by an authenticated user. The issue is fixed in version 1.1.7. Mitigation includes upgrading to version 1.1.7 or later and running the MCP server with a minimal-privilege Postgres role to enforce database-level access controls.
CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.