CVE-2026-129427 is a stored cross-site scripting (XSS) vulnerability in CervantesSec cervantes version v1.3-beta. It involves an attacker uploading a malicious avatar that exploits an authentication bypass in the /Attachments endpoint, leading to account takeover (ATO) by executing arbitrary code in another user's browser with elevated privileges.
Apple has detailed its Secure Exclaves architecture designed to isolate camera and microphone data used for ambient sensing from the main operating system on devices such as HomeView and new iPhones. This architecture ensures that sensitive sensor data cannot be accessed or altered by the main OS or apps, with only limited metadata shared under strict conditions. Secure Exclaves run on a formally verified microkernel to enhance security and prevent kernel compromise. The design includes user-visible indicators for sensor activity that the main OS cannot interfere with, enhancing privacy and security.
A numeric range comparison vulnerability exists in Akaunting versions 3.0 through 3.3.0 in the function calculation_to_quantity within helpers.php related to Invoice Item Validation. This flaw allows remote attackers to manipulate the quantity argument without a minimum check, potentially leading to incorrect validation outcomes. The vendor has not responded to the disclosure. The CVSS 4.0 score rates this as a medium severity issue.
CVE-2026-129247 is a path traversal vulnerability in yangzongzhuan RuoYi versions 4.8.0 through 4.8.3. The flaw exists in the VelocityUtils.getFileName function within the Code Generator component. An attacker can remotely manipulate the className argument to perform path traversal, potentially accessing unauthorized files.
The PyPI package 'xrfdc' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The Flatsome WordPress theme up to version 3.20.12 is vulnerable to stored cross-site scripting (XSS) via insufficient sanitization of certain HTML attributes ('data-text-sec', 'data-title', and 'title') in custom HTML blocks. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because WordPress's wp_kses_post function allows global data-* attributes, enabling attacker-controlled values to persist and be interpreted as executable HTML by specific JavaScript behaviors in the theme.
The Duplicate Post WordPress plugin before version 1.5.8 contains an authorization flaw where it does not verify if a user duplicating a post has permission to edit that post. When the slug takeover option is enabled, this allows users with roles granted access by an administrator, such as Contributor, to move any readable post off its original permalink and publish their duplicate at that address.
The SEOJuice WordPress plugin versions before 2.12.0 have a vulnerability where the REST API authentication filter is not properly restricted. This flaw disables WordPress's REST nonce protection site-wide, allowing unauthenticated attackers to perform any cookie-authenticated REST action. An attacker can exploit this by tricking a logged-in administrator into visiting a crafted page, enabling actions such as creating a new administrator account via CSRF.
The Duplicate Post WordPress plugin versions before 1.5.8 lack a proper capability check when saving global settings. Instead, they rely solely on their own role-access list, which can be manipulated by users with any role granted access by an administrator, including low-privilege roles such as Subscriber. This flaw allows such users to overwrite global settings, including the role-access list itself.
The Lightbox with PhotoSwipe WordPress plugin versions prior to 5.19.0 contain a vulnerability where link titles and other caption sources are not properly sanitized before being inserted as HTML into image lightbox captions. This flaw allows unauthenticated users to inject stored cross-site scripting (XSS) payloads via comments.
The Flatsome WordPress theme versions prior to 3.20.13 contain a vulnerability where the theme does not enforce user role restrictions on an AJAX save action. This flaw allows users with the Contributor role to publish their own content and change its post type, such as converting a post into a product, without having the necessary permissions.
The Flatsome WordPress theme versions prior to 3.20.13 contain a vulnerability where an AJAX action accessible to unauthenticated users lacks capability and nonce checks. This flaw allows unauthorized users to retrieve content from unpublished posts, including drafts and pending posts, by specifying post IDs.
The WP Ultimate CSV Importer and WP Ultimate CSV Importer Pro WordPress plugins before versions 9.2 and 9.0.7 respectively, expose exported post files via a publicly accessible location with predictable filenames. This allows unauthenticated attackers to download content and custom fields of any exported post, including non-public content.
The Chargely Free Subscriptions For Woocommerce WordPress plugin up to version 1.0 has a vulnerability where it does not perform authorization checks on a REST API route that exposes its stored configuration. This flaw allows unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret, which provide full read and write access to the entire store.
The Checkout Files Upload for WooCommerce WordPress plugin versions before 2.4.1 contains a vulnerability where it does not properly verify that uploaded files at checkout are allowed image types. This flaw allows unauthenticated users to upload HTML files disguised as images, which can execute JavaScript in the browser of a shop manager or administrator viewing the order screen. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.
A SQL injection vulnerability exists in projectworlds Visitor Management System 1.0 in the Login Endpoint's /img/user page.php file. The vulnerability allows remote attackers to manipulate the Username parameter in the mysqli_query function, potentially leading to unauthorized data access and modification. Public exploit code has been disclosed. The vulnerability has a high severity rating with a CVSS score of 7.3.
The Swipe WordPress plugin versions through 1.4 contain a vulnerability where login requests are not properly authenticated before issuing WordPress session cookies. This flaw allows unauthenticated attackers to log in as any existing user, including administrators, if that user has an active app session.
The Duplicate Post WordPress plugin versions before 1.5.8 have a vulnerability where the plugin does not verify if a user has permission to publish posts when duplicating them. This flaw allows users with roles granted access to the plugin, such as Contributors, to create published posts, including posts attributed to other users.
The Quick Page/Post Redirect Plugin for WordPress versions before 5.2.4 contained a hidden update mechanism that fetched updates from the author's own server instead of the official WordPress.org repository. This mechanism was exploited to deliver a backdoored plugin build (notably version 5.2.3) that injected arbitrary content into pages and delivered arbitrary code, primarily serving SEO spam to logged-out visitors. The plugin was removed from WordPress.org, and a clean version 5.2.4 was later published to address this issue.
The WP Ultimate CSV Importer WordPress plugin versions before 9.3 contain a vulnerability where values from imported files are not escaped before use in SQL queries when importing LifterLMS content. This flaw allows high privilege users, such as administrators on single or multisite WordPress installations, to perform SQL injection attacks.