The Shipo WordPress plugin versions 1.6 through 1.8.0 contain an authentication bypass vulnerability. The flaw arises because the authenticate_rest_user() function accepts a LOGGED_IN_COOKIE value and authenticates the user without verifying the cookie's cryptographic signature. Additionally, the intended restriction to the /wp-json/shipo/ REST API route can be bypassed by including that substring in the query string of other REST endpoints. This allows unauthenticated attackers who know a valid username to impersonate that user, including administrators, and perform privileged actions such as creating new administrator accounts.
The MemberDash plugin for WordPress contains a privilege escalation vulnerability in versions up to and including 1.8.7. This flaw allows authenticated users with subscriber-level access or higher to manipulate the user ID parameter in a way that overwrites any WordPress user's email and password, including administrators. This vulnerability arises from a mass-assignment issue in the user_account_manager() function where no proper validation or capability checks are performed on submitted data.
The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads WordPress plugin is vulnerable to an arbitrary file write vulnerability due to missing authorization checks and insufficient path validation. This flaw affects all versions up to and including 1.2.0. An unauthenticated attacker can exploit this to write files outside the intended directory, potentially leading to remote code execution if a PHP file is written in a web-accessible location.
CVE-2025-71464 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.4. The flaw occurs in the toggleEditorMode() function, which assigns source view text directly to innerHTML without proper sanitization using Angular's DomSanitizer. This allows attackers to craft HTML containing event handlers (e.g., img onerror) that execute scripts in the application's origin when users toggle between editor views.
CVE-2025-71465 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.3. The vulnerability arises because the refreshView() function writes HTML content from ngModel or reactive form controls directly to innerHTML without using Angular's DomSanitizer, bypassing default sanitization. This allows attackers to inject HTML with event-handler attributes that execute scripts in the application's origin when loaded in the editor. The issue is fixed in version 3.0.3.
Pulse versions from 5.0.17 up to but not including 6.8.0 have a missing authorization vulnerability in the /api/ai/approvals endpoints. Authenticated users with viewer-level privileges can improperly manage approval requests, including listing pending requests and approving or denying requests made by others. This flaw allows alteration of decision and audit states without proper authorization.
CVE-2026-129429 is a missing authorization vulnerability in the frappe india-payroll software versions before 16.0.4. It affects the get_employee_details, compute_tax_comparison, and set_tax_regime methods in tax_regime_selector.py. Authenticated low-privileged users can exploit this flaw to access payroll data of other employees, including base pay and earning and deduction components. They can also alter the tax regime on draft Salary Structure Assignments, potentially impacting tax withholding. The vulnerability has a high severity score of 7.1 and was fixed in version 16.0.4.
Axeloz Filesharing versions before 2.14.3 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts by embedding raw HTML or javascript: Markdown links in bundle descriptions. When recipients view the public bundle preview page, the injected script executes via Alpine x-html, potentially allowing attackers to steal the owner_token from localStorage and perform owner-scoped actions on victim bundles.
Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the SOCKS5 dissector. This flaw allows network-adjacent attackers to send crafted SOCKS5 authentication packets that cause Ettercap to read up to 255 bytes beyond the heap buffer. The leaked memory can include sensitive information printed and logged as captured credentials.
Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the dissector_mountd() function. This flaw occurs because the function validates RPC credential and directory lengths independently rather than against the packet boundary, allowing an attacker to read up to 100 bytes beyond the heap buffer. The vulnerability can be triggered by a network-adjacent attacker sending a crafted MOUNT MNT call, potentially leaking memory contents to the console and logs.
Dokploy versions before 0.31.1 contain an OS command injection vulnerability in the getComposeContainerCommand() function. Authenticated organization members can exploit this flaw by injecting shell commands via the serviceName parameter, which is stored through backup.create or backup.update procedures. When scheduled backups run, these commands execute with root privileges due to the mounted Docker socket, allowing full host takeover. This vulnerability is critical and has been fixed in version 0.31.1.
CVE-2026-129255 is a critical vulnerability in CoolerMaster MASTERPLUS+ version 1.9.6 involving incorrect default permissions in the WinRing0x64.sys device driver component. The flaw arises from improper handling of the PhysicalAddress argument in the sub_11504 function, allowing local attackers to exploit permission issues. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
A malicious file identified by the SHA-256 hash ae0e7b77c1e3861661e63f0c615b842232851b8021f24eefd63ce9f88023012d was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file is associated with CVE-2026-109618 and was detected four times during attacker activity on that date. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was likely used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the Netherlands. There is no information on affected software versions or confirmed exploitation in the wild.
CVE-2026-129254 is a medium severity cross-site scripting (XSS) vulnerability in Opixido OCMS affecting an unknown function in admin/TUI/index.php. The vulnerability arises from manipulation of the 'img' argument, allowing remote attackers to execute script code. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor did not respond to disclosure attempts, and no patch information is available. Exploit code has been published but no confirmed exploitation in the wild is reported.
CVE-2026-129115 is a use-after-free vulnerability in JSON::XS for Perl versions 3.0 up to but not including 4.05. The flaw occurs when encoding objects with allow_tags enabled, where the FREEZE method's serialization can cause the Perl stack to grow and reallocate, leaving saved pointers referencing freed memory. This can lead to reading freed stack memory and potentially returning undefined values without error during encoding.
JSON::XS versions from 3.04 up to but not including 4.05 for Perl contain an off-by-one error in the incr_parse function. This flaw causes the software to write one byte past the end of a heap buffer when appending a one-byte chunk during incremental parsing. The issue arises because the incremental buffer grows to one and a half times the required length without reserving space for the terminating NUL byte, leading to a heap out-of-bounds write under certain input conditions. The vulnerability is fixed in version 4.05.
CVE-2026-129113 is an integer underflow vulnerability in JSON::XS for Perl versions from 4.0_00 before 4.05. The flaw occurs in the incremental parser's buffer length management when parsing top-level numbers, leading to buffer corruption and potential process termination due to an out-of-memory error.
CVE-2026-124541 is a memory leak vulnerability in JSON::XS for Perl versions before 4.05. The flaw occurs in the decode_str function, where decoded parts of rejected long strings are not freed properly. This leads to retained memory from each rejected string, potentially exhausting process memory over time.
CVE-2026-124540 is a vulnerability in JSON::XS for Perl before version 4.05 that allows stack exhaustion via uncontrolled recursion when decoding nested tagged values with allow_tags enabled. This leads to an uncatchable segmentation fault caused by C stack exhaustion regardless of the max_depth setting.
CVE-2026-124539 is a memory leak vulnerability in JSON::XS for Perl versions before 4.05. The flaw occurs when decoding an object with a missing colon after a key, causing the decoded key scalar to not be freed. This results in a memory leak where each rejected document retains one key in memory, potentially exhausting process memory over time.