MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability in the password recovery mechanism. The function check_msg() does not properly verify the recipient of the recovery code, allowing attackers to reset any user's password by submitting a recovery code sent to their own mailbox but associating it with the victim's email or phone number. This flaw enables account takeover without authentication.
CVE-2026-116213 is an arbitrary file read vulnerability in Webasyst Framework versions up to 4.4.0. It arises from improper validation of symbolic link targets when authenticated users with theme management rights upload themes containing symlinks. This flaw allows reading sensitive files such as wa-config/db.php or /etc/passwd via the public theme path.
CVE-2026-116212 is a stored cross-site scripting (XSS) vulnerability in the Webasyst Framework up to version 4.4.0, specifically in the Photos app. Authenticated backend users with album edit rights can inject malicious JavaScript via the album url parameter, which is not properly escaped in the DialogAlbumSettings.html file. This allows execution of arbitrary JavaScript in administrator backend sessions.
CVE-2026-116210 is a cross-site request forgery (CSRF) vulnerability in the Webasyst Framework's Photos app up to version 4.4.0. The vulnerability arises because the Photos app does not enable the framework's opt-in CSRF protection, allowing attackers to trick logged-in users into submitting forged POST requests. These requests can delete photos or modify access rights without user consent.
CVE-2026-116281 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19 affecting the ListProfiles function in the Profile Controller component. The vulnerability allows local attackers to access sensitive information. This issue is resolved by upgrading to version 5.2.0.
CVE-2026-107157 is an out-of-bounds read vulnerability in the Qt Framework's QCborValue::fromCbor() function. It affects multiple versions of Qt from 5.12.0 through 6.8.8 and from 6.9.0 through 6.11.2. The vulnerability has a low CVSS score of 2.0, indicating limited impact and exploitability. There are no known exploits in the wild, and no official patch information is provided in the available data.
An Open Redirect vulnerability (CWE-601) exists in Mautic's public form submission endpoint (/form/submit). After submitting a form, the application redirects users to a return URL supplied in the submission without verifying if it points to a trusted host. This allows unauthenticated attackers to redirect visitors from a legitimate Mautic domain to arbitrary external sites, potentially phishing or malware sites. The vulnerability affects Mautic versions >=1.0.0-beta <5.2.12, >=6.0.0 <6.0.10, and >=7.0.0 <7.2.2. Fixed versions are 5.2.12, 6.0.10, and 7.2.2.
CVE-2026-115195 is a broken access control vulnerability in the Mautic Stats API endpoint (/api/stats/{table}) that allows any authenticated API user to read data from internal tables without proper authorization. This includes sensitive information such as application audit logs, user actions, contact personal data, visitor IP addresses with geolocation, and tracked redirect URLs. The flaw exists because administrator-only restrictions were never enforced and tables without explicit permission mappings were readable by default. The vulnerability affects multiple Mautic core versions and has been fixed in versions 5.2.12, 6.0.10, and 7.2.2.
CVE-2026-115194 is a path traversal vulnerability in the Mautic Asset API that allows an authenticated user with asset creation permissions to register and publish arbitrary files readable by the web server. This results in unauthorized disclosure of sensitive files, including configuration files containing database and SMTP credentials, via a public URL without authentication.
A long-running malware campaign has infected 953 online stores, primarily Magento-based, with loader code that selectively serves malicious payloads to real visitors to evade detection. The campaign began in July 2025 and has used multiple domains for its JavaScript loader, with recent activity observed as late as October 2026. The loader performs visitor fingerprinting and has been delivered through exploitation of known Magento vulnerabilities and backdoors. Store owners are advised to check for loader code, vulnerabilities, backdoors, rogue admin accounts, and to apply the latest patches and security measures.
A stored Cross-Site Scripting (XSS) vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2 allows an attacker to inject malicious scripts via HTML-type custom contact fields. When an affected contact's detail page is viewed, the script executes in the context of the viewer's browser session, potentially enabling administrative actions such as creating admin accounts or accessing sensitive data. This vulnerability is fixed in version 7.2.2.
CVE-2026-115192 is an SQL Injection vulnerability in the Mautic core dashboard widget data API endpoint (/api/data/{type}). It allows an authenticated user with API access to inject SQL via chart filter parameters that are not properly validated. Exploitation can lead to unauthorized reading of arbitrary database data, including sensitive contact, marketing, and user account information with password hashes. The vulnerability does not allow data modification but can be used to degrade database query performance, impacting availability. Exploitation requires the Mautic API to be enabled.
Kameleo versions up to 5.0.1.19 contain a server-side request forgery (SSRF) vulnerability in the InternalController.TestProxy function of the Proxy Validation component. This vulnerability allows remote attackers to manipulate host and port arguments to induce SSRF. The issue is addressed in version 5.2.0, where the vulnerable route was removed and replaced.
CVE-2026-115191 is a SQL injection vulnerability in the Mautic administration interface's contact lookup AJAX endpoint (/s/ajax). It allows any authenticated user, regardless of role or permissions, to execute arbitrary SQL queries on the Mautic database by exploiting improper validation of a request parameter. This can lead to unauthorized reading of sensitive data such as user accounts, password hashes, contact information, and campaign content. The vulnerability affects multiple Mautic core versions and has been assigned a high severity rating.
CVE-2026-115190 is a high-severity deserialization vulnerability in Mautic's core affecting versions >=2.15.2 <5.2.12, >=6.0.0 <6.0.10, and >=7.0.0 <7.2.0. It involves insecure deserialization of PHP objects from segment filters and custom field properties, allowing an attacker with write privileges to inject crafted serialized data. This can lead to arbitrary code execution, data disclosure, modification, or deletion, and impact availability. The vulnerability is fixed in versions 5.2.12, 6.0.10, and 7.2.0.
CVE-2026-115189 is a server-side template injection vulnerability in Mautic's Twig theme rendering sandbox. The sandbox, intended to restrict user-uploaded theme templates, does not fully enforce restrictions, allowing an authenticated user with core:themes:create permission to upload a malicious theme. This can lead to arbitrary code execution on the server with web server privileges, including OS command execution, file read/write, and access to internal services. The vulnerability affects multiple Mautic versions prior to fixed releases.
CVE-2026-115188 is a critical unrestricted file upload vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2. It affects the campaign import feature, allowing authenticated users with campaign import permissions to upload arbitrary files, including server-side scripts, to a publicly accessible media directory. This can lead to remote code execution on web servers that honor per-directory configurations, such as Apache in the official Mautic Docker image, without requiring administrator privileges.
CVE-2026-116275 is a code injection vulnerability in AllenAI AllenNLP versions 2.10.0 and 2.10.1. It affects the Registrable.resolve_class_name function in the Registrable Configuration Machinery component. The vulnerability allows remote attackers to perform code injection by manipulating the argument Type. The exploit code has been publicly disclosed. The affected versions are no longer supported by the vendor.
Frappe CRM versions before 1.89.1 have a missing authorization vulnerability in the get_contact_by_phone_number API. This flaw allows authenticated users with low privileges to query CRM Lead records they should not access by supplying a phone number, bypassing normal permission checks. The vulnerability leads to unauthorized disclosure of sensitive CRM lead data.
CVE-2026-110475 is a critical vulnerability in the CreditNirvana Collections Platform (CollectionWorkz) caused by weak authentication and authorization controls in the platform login service. An unauthenticated remote attacker can exploit this flaw to manipulate authentication requests and access APIs without a valid session. This allows the attacker to enumerate users, impersonate arbitrary users including administrators, and access or modify sensitive data with the privileges of the impersonated user.