CVE-2026-109695 is a vulnerability in WPManageNinja FluentCart versions prior to 1.8.0 that allows insertion of sensitive information into sent data. This flaw enables attackers to retrieve embedded sensitive data without requiring privileges or user interaction. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-109694 is a critical vulnerability in WP ManageNinja LLC's Fluent CRM plugin that allows incorrect privilege assignment leading to privilege escalation. It affects all versions from initial releases up to and including 3.2.5. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
The Android application 'Vehicle Inspection Certificate Viewer' by the Ministry of Land, Infrastructure, Transport and Tourism has a vulnerability where sensitive information, including API integration credentials like access ID and access key, may be included in data sent by the app. This could lead to exposure of these credentials. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or remediation information is currently provided.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.5.14 is vulnerable to stored Cross-Site Scripting (XSS) via the 'ref' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
Parse Server versions before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 have a vulnerability where errors during sending verification or password reset emails are not handled properly, causing the server process to exit. This can be triggered by a client using only public application keys when the mail provider rejects, rate limits, or is unavailable.
CVE-2026-100232 is a high-severity vulnerability in SonicWall Network Security Manager (NSM) on-premises. It is an OS command injection flaw that occurs post-authentication and could allow a remote authenticated attacker to execute arbitrary operating system commands, leading to remote code execution.
CVE-2026-96540 is an improper access control vulnerability in SonicWall Network Security Manager (NSM) on-premises export settings. It allows a remote authenticated attacker with limited privileges to potentially access sensitive information. Exploitation may lead to privilege escalation to administrator level or interception of other users' communications within the NSM instance. The vulnerability has a high severity rating with a CVSS score of 8.8.
ILIAS versions before 9.24, 10.12, and 11.5 contain a PHP object injection vulnerability allowing authenticated users with Test creation or import permissions to execute arbitrary code by deserializing crafted Test archives. The vulnerability arises from unsafe unserialize() calls on a malicious tst_sequence attribute, enabling abuse of Guzzle or Monolog gadget chains to write PHP files and execute code remotely. The CVSS 4.0 score is 8.7, indicating high severity.
CVE-2026-108484 is a stored cross-site scripting (XSS) vulnerability in the WPManageNinja Best Payments Plugin for WordPress. It affects versions from initial release up to 4.6.27. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The impact includes potential partial confidentiality, integrity, and availability loss. No patch or remediation information is provided in the available data.
CVE-2026-101954 is a critical improper authentication vulnerability in the J-Web management interface and NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network attacker to gain root-level device configuration access and take over the device via reachable J-Web HTTP or HTTPS services when web management is enabled.
CVE-2026-101952 is a high severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper validation of consistency within input, allowing a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update processed by BMP route monitoring or NSR. This vulnerability can lead to denial of service due to the crash of the routing daemon.
CVE-2026-101949 is a NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated remote BGP neighbor can trigger a denial of service by sending a VPN-flowspec BGP update that is readvertised when BMP post-policy RIB-out monitoring is enabled. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS 3.1 base score is 7.5, indicating high severity due to the potential for denial of service without requiring authentication.
CVE-2026-101964 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent attacker can cause the rpd process to crash by sending a specially crafted Label Distribution Protocol (LDP) packet over an established LDP session. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The vulnerability has a CVSS v3.1 score of 6.5, indicating a medium severity impact primarily due to availability disruption.
CVE-2026-101963 is a high-severity vulnerability in Juniper Networks Junos OS and Junos EVO. It involves an incorrect calculation in the routing protocol daemon (rpd) that can be triggered remotely by a BGP EVPN neighbor when SRv6 EVPN multihoming is configured. Exploitation causes the rpd process to crash, resulting in denial of service. The vulnerability affects multiple specific versions of Junos OS and Junos EVO as detailed in the affected versions list. No known exploits are reported in the wild. The CVSS score is 7.5, indicating a high impact on availability but no confidentiality or integrity impact.
CVE-2026-101962 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper handling of length parameter inconsistency in processing BGP EVPN multicast updates, which can cause the rpd process to crash. This vulnerability does not impact confidentiality or integrity but results in denial of service due to process crash. Multiple versions of Junos OS and Junos OS Evolved are affected across various release streams. No known exploits in the wild have been reported. Patch status is not confirmed in the provided data; users should consult Juniper's official advisories for remediation guidance.
CVE-2026-101961 is a NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured eBGP peer to cause a denial of service of the routing daemon by sending a specific BGP packet when a nexthop-ecmp qualifier is attached to a BGP import policy. This vulnerability has a high severity score of 7.5 and impacts multiple versions of Junos OS and Junos OS Evolved.
CVE-2026-101959 is a vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves a function call with an incorrect variable or reference as an argument, which can be triggered by an unauthenticated adjacent attacker using a specially crafted LSP-ping message. Successful exploitation causes the rpd process to crash, resulting in a denial of service. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity).
CVE-2026-101983 is a critical stack-based buffer overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network attacker to remotely execute code and cause denial of service when a J-Web virtual-domain is configured. The vulnerability affects multiple specific versions of Junos OS and Junos OS Evolved. The CVSS score is 9.8, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.
CVE-2026-101982 is a critical stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured BGP/EVPN peer to cause root code execution on Junos OS or crash the rpd process on Junos OS Evolved by sending protocol-valid route advertisements for an EVPN-VPWS service. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges required, and impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Juniper Networks has not provided explicit patch links in the input data, so patch status should be verified with the vendor.
CVE-2026-101981 is a stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent LDP peer to cause a crash or execute arbitrary code by sending a malformed LDP Label Mapping message. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.