CVE-2026-119513 is a missing authorization vulnerability in Ahmad JS Help Desk affecting versions before 5.0.4. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue has been fixed in version 5.0.4.
CVE-2026-123468 is a missing authorization vulnerability in the StylemixThemes Motors plugin for motors-car-dealership-classified-listings. It affects versions from initial releases up to 1.4.128. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 1.4.129. The CVSS score is 4.3, indicating a medium severity impact primarily on integrity with no confidentiality or availability impact.
CVE-2026-120857 is a missing authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat versions prior to 6.1.10. The flaw allows exploitation due to incorrectly configured access control security levels. This vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability. A fix is available in version 6.1.10.
CVE-2026-123148 is a missing authorization vulnerability in TMS IvyForms versions before 1.5.2. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 1.5.2.
CVE-2026-120837 is a missing authorization vulnerability in Everest Forms versions prior to 3.6.4. It allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue is fixed in version 3.6.4.
CVE-2026-121724 is a missing authorization vulnerability in the WebberZone Contextual Related Posts plugin affecting versions prior to 4.5.4. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionalities. The issue is fixed in version 4.5.4.
CVE-2026-120364 is a stored cross-site scripting (XSS) vulnerability in Untapwp Vidplex versions prior to 1.0.4. The flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can affect confidentiality, integrity, and availability. The issue is fixed in version 1.0.4.
CVE-2026-119523 is a missing authorization vulnerability in Cozmoslabs Paid Member Subscriptions plugin versions before 3.1.4. It allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The issue is fixed in version 3.1.4.
CVE-2026-119525 is a missing authorization vulnerability in the WP Desk Dropshipping XML for WooCommerce plugin versions prior to 1.7.5. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The issue is fixed in version 1.7.5.
CVE-2026-120365 is a stored cross-site scripting (XSS) vulnerability in the WP Customer Area plugin by Aguila Technologies. It affects versions from initial releases up to 8.4.3. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. A fix is available in version 8.4.4.
The qzc690383 package on PyPI contains malicious code that executes during installation. It collects detailed host system information and sends it encoded to a local Xinference server, enabling an operator with access to that server to retrieve the host fingerprint. The package does not provide legitimate functionality and performs this reconnaissance even on a simple install.
The PyPI package 'qzc690382' version 1.0.0 contains malicious code that activates during installation. Its setup.py script writes and launches a persistent Python HTTP server on multiple ports, exposing a network-accessible shell that executes arbitrary shell commands received via HTTP GET requests. This backdoor runs with the privileges of the installing user and is unrelated to any legitimate functionality.
The PyPI package 'qzc690385' versions 1.0.0 and 1.0.1 contains malicious code that installs a Python HTTP server on installation. This server listens on multiple ports and allows remote execution of arbitrary shell commands via HTTP GET requests authenticated by a hardcoded token. Additionally, the package abuses a local Xinference API to execute code and exfiltrate host reconnaissance data encoded within model registration payloads. The package provides no legitimate functionality and is designed for stealthy remote control and data gathering.
CVE-2026-119478 is a medium severity vulnerability in StylemixThemes MasterStudy LMS versions prior to 3.7.57. It involves improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects all versions from initial through 3.7.56 and has been fixed in version 3.7.57.
CVE-2026-119508 is a missing authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services. It affects versions from initial releases up to 1.0.20. The flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.0.21.
CVE-2026-119492 is a medium severity vulnerability in Metaphor Creations, LLC Ditty plugin (ditty-news-ticker) that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) issue. The vulnerability affects versions from initial releases up to 3.1.71. It has been fixed in version 3.1.72.
CVE-2026-119501 is a stored cross-site scripting (XSS) vulnerability in BdThemes Element Pack Elementor Addons affecting versions prior to 10.0.3. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to execute malicious scripts. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fix is available in version 10.0.3.
CVE-2026-19868 is a high-severity vulnerability in SonicWall's SonicOS SSL VPN component that allows an attacker with valid credentials for an alternate authentication method to bypass SAML authentication controls, including SAML-enforced multi-factor authentication (MFA). This flaw affects SonicWall Gen7 and Gen8 firewalls running SonicOS versions 7.3.3-7015 or older and 8.2.2-8015 or older, respectively. SonicWall has released patched versions 7.3.4-7013 and 8.2.3-8015 to address the issue. There are no known workarounds, and customers are urged to upgrade promptly. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating potential exploitation in the wild.
CVE-2026-123961 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWiFiBasicConfig function within the /cgi-bin/cstecgi.cgi file, where improper handling of the KeyStr argument allows remote attackers to trigger a buffer overflow. Public exploit code has been disclosed, increasing the risk of exploitation.
CVE-2026-121783 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Data Access plugin by Passionate Programmer Peter. It affects versions from initial releases up to 5.5.90. The vulnerability allows an attacker to induce a user to perform unwanted actions without their consent. A fix is available in version 5.5.91.