Threat database

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-116259 is a medium-severity memory corruption vulnerability in libimobiledevice up to version 1.4.0. It affects the afc_get_device_info_key function in the Device Info Handler component. The flaw is triggered by manipulating the argument Value, causing memory corruption. Exploit code has been publicly released, but exploitation requires local access. The vendor has not responded to the disclosure and no patch information is available.

CVE-2026-116258 is a heap-based buffer overflow vulnerability in libimobiledevice affecting versions 1.0 through 1.4.0. The flaw exists in the AFC component, specifically in the src/afc.c file. This vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure attempts. The CVSS 4.0 score is 5.3, indicating medium severity.

CVE-2026-89209 is an authentication bypass vulnerability in Siemens Mendix SAML modules for Mendix 9, 10, and 11 compatible versions prior to 3.6.29 and 4.2.4 respectively. The flaw allows unauthenticated remote attackers to replay valid SAML assertions in IdP-initiated authentication flows, potentially gaining unauthorized access to applications.

CVE-2026-114708 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetSmartFilters versions before 3.8.6.2. It allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and requiring user interaction to execute malicious scripts. The issue is fixed in version 3.8.6.2.

CVE-2026-115595 is a missing authorization vulnerability in the Contact Form by Supsystic plugin, affecting versions from initial up to 1.10.7. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 1.11.1.

MISP Guard, a security filter for MISP feed distribution, has a case-sensitivity flaw in multiple policy enforcement checks. This flaw allows attackers with event creation privileges to bypass configured allow/block lists by altering the letter case of taxonomy tags, attribute categories, or sharing-group UUIDs. As a result, unauthorized threat intelligence data may be disclosed to downstream consumers, violating confidentiality policies.

CVE-2026-115959 is a missing authorization vulnerability in the WPExperts APIExperts Square for WooCommerce plugin. Versions from initial release up to 4.7.5 are affected. The flaw allows exploitation due to incorrectly configured access control, potentially leading to unauthorized actions. The issue is fixed in version 4.7.6.

CVE-2026-115960 is a missing authorization vulnerability in the WPExperts APIExperts Square for WooCommerce plugin versions before 4.7.6. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The issue is fixed in version 4.7.6.

CVE-2026-115955 is a stored cross-site scripting (XSS) vulnerability in the bPlugins Advanced Post Block - Post Grid for WordPress block editor. It affects versions from initial release up to 2.5.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. A fix is available in version 2.5.2.

CVE-2026-115956 is a stored cross-site scripting (XSS) vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer affecting versions from initial through 1.8.3. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The issue is fixed in version 1.8.4.

CVE-2026-115961 is a stored cross-site scripting (XSS) vulnerability in bPlugins B Slider up to version 2.2.2. It involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to inject malicious scripts. The vulnerability is fixed in version 2.2.4.

CVE-2026-116257 is a vulnerability in BillaBear version 2025.01.03 affecting the Installation Handler component. Specifically, the processInstall function in src/BillaBear/Controller/InstallController.php lacks proper authentication, allowing remote attackers to exploit this flaw without credentials. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed with available exploit information. The vendor has not responded to the disclosure, and no patch or remediation is currently documented.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.

Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.

CVE-2026-115608 is a high-severity SQL Injection vulnerability in Crocoblock JetEngine versions prior to 3.9.0.1. It allows improper neutralization of special elements in SQL commands, potentially enabling an attacker with low privileges to execute unauthorized SQL queries. The vulnerability affects all versions from initial release up to 3.9.0 inclusive. A fix is available in version 3.9.0.1.

CVE-2026-115953 is a stored cross-site scripting (XSS) vulnerability in the Geo Mashup plugin developed by Dylan Kuhn. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts. This vulnerability affects Geo Mashup versions from the initial release up to 1.13.22. A fix is available in version 1.13.23. The CVSS 3.1 base score is 6.5, indicating a medium severity level.

CVE-2026-115954 is a missing authorization vulnerability in Dylan Kuhn's Geo Mashup plugin affecting versions up to 1.13.22. The flaw allows exploitation due to incorrectly configured access control security levels. A fix is available in version 1.13.23. The vulnerability has a medium severity with a CVSS score of 5.4.

CVE-2026-115950 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Better Post & Filter Widgets for Elementor by WP Smart Widgets. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. Versions from initial release up to 1.9.1 are affected. The issue is fixed in version 1.9.2.