A Cross-Site Scripting (XSS) vulnerability exists in myCred up to version 4.0.2 due to improper neutralization of script-related HTML tags, allowing code injection. This vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation details are provided in the available data.
A vulnerability in OpenShift Pipelines-as-Code (PAC) allows a namespace user with limited permissions to escalate privileges within that namespace. The flaw arises because PAC does not verify if the creator of a Repository custom resource is authorized to create PipelineRuns. This enables execution of attacker-controlled PipelineRuns with the pipeline ServiceAccount, which by default has ClusterRole/edit permissions. The result is namespace-scoped privilege escalation, allowing unauthorized reading of Secrets, resource manipulation, and potential supply chain injection in CI/CD namespaces.
A missing authorization vulnerability exists in WProyal Royal Elementor Addons (royal-elementor-addons) affecting versions up to 1.7.1068. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact primarily on confidentiality. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.
A vulnerability in OpenBMB Internet of Agents affects the _primary_field_query function in the Agent Registry component. The flaw involves improper neutralization of special elements in data query logic due to manipulation of the argument key. This vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so no specific affected or fixed versions are identified. The project has been notified but has not yet responded or issued a fix. The CVSS score is 7.3, indicating high severity.
A missing authorization vulnerability exists in WP SYNTEX Polylang plugin versions up to 3.9. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability has a medium severity rating with a CVSS score of 5.4.
UgCS server versions before 6.2 have an authentication bypass vulnerability in the HCI protocol login handler on TCP port 3334. If the user database contains exactly one user, a login request with empty credentials is accepted as that user, granting a fully authenticated session. The service listens on all interfaces without TLS by default, allowing unauthenticated remote attackers with network access to port 3334 to gain privileged access, including commanding drones and uploading flight routes.
A missing authorization vulnerability exists in PublishPress Revisions (revisionary) up to version 4.2.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized modification actions. The vulnerability has a medium severity rating with a CVSS score of 4.3 and does not impact confidentiality or availability but affects integrity.
A security vulnerability exists in chenyme grok2api versions up to 3.1.6 in the STT Billing component, specifically in an unknown function within backend/internal/transport/http/inference/voice_ws_handler.go. This vulnerability allows remote attackers to enforce behavioral workflow. The issue is resolved by upgrading to version 3.1.7.
CVE-2026-71881 is a stored cross-site scripting (XSS) vulnerability in the GBIF Integrated Publishing Toolkit affecting versions before 3.3.5. Authenticated remote attackers can inject malicious code into resource metadata fields, which executes in another user's session after interaction. The vulnerability has a medium severity score of 4.8 and requires user interaction for exploitation.
CVE-2026-109469 is a critical authorization bypass vulnerability in Microsoft Entra Device Registration. It involves a user-controlled key that allows an unauthorized attacker to elevate privileges over a network. This vulnerability has a CVSS score of 10.0, indicating maximum severity. An official fix is available from Microsoft.
CVE-2026-118786 is an improper input validation vulnerability in the non-secure-callable veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example. This flaw affects versions up to 26.06.00-lts and 26.09.00, allowing a non-secure caller to supply unvalidated pointers and size values. Exploitation could lead to disclosure of secure-world memory or denial of service. The issue is fixed in versions 26.06.01-lts and 26.12.00-pvw1.
CVE-2026-118785 is an improper input validation vulnerability in the NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples. It affects versions prior to 26.06.01-lts and 26.09.00. The flaw allows a non-secure caller to supply unvalidated pointers or untrusted data, which may lead to timing side-channel attacks, TOCTOU conditions, or format-string misuse. This can potentially result in secure-world memory disclosure or denial of service. The issue has been fixed in versions 26.06.01-lts and 26.09.00.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.