Search: 5.1.8.3

The Photo Engine WordPress plugin versions up to 6.5.8 lack proper authorization checks on a REST API route used to update post data. This vulnerability allows authenticated users with Author-level access or higher to modify titles, content, excerpts, and other fields of arbitrary posts, pages, and attachments, including those owned by other users. The issue is fixed in version 6.6.0.

The Frontend Dashboard WordPress plugin before version 3.0.5 and the ProfileGrid WordPress plugin before version 6.0.0.5 contain a vulnerability that allows unauthenticated users to store serialized PHP objects in user metadata. These objects are deserialized when a public profile is viewed, enabling PHP object injection that can lead to arbitrary file write and potential remote code execution.

An information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that results in leaking information. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A vulnerability in the Two Factor Authentication WordPress plugin (before 1.17.0) and the All-In-One Security (AIOS) WordPress plugin (before 5.5.0) allows improper authentication. The flaw occurs because the plugins do not bind the two-factor authentication code to the account being authenticated. An attacker who knows a victim's password and has their own two-factor-enabled account can bypass the victim's second-factor check by using their own two-factor code, thereby gaining access to the victim's session.

Node Version Manager (nvm) versions 0.31.2 through 0.40.5 contain an OS command injection vulnerability in the nvm_ls function. This occurs because version strings with '#' characters can prematurely close a sed address, allowing execution of arbitrary shell commands via GNU sed's 'e' command or BSD sed's 'w' and 'r' commands. This vulnerability can be triggered by attacker-controlled version strings passed to various nvm commands or environment variables, and is exploitable when at least one version is installed. Version 0.40.6 fixes this issue by filtering version patterns containing '#' or newlines before they reach the vulnerable sed command.

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish WordPress plugin versions up to 4.1.12 contains a SQL Injection vulnerability via the 'exclude_posts' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and query preparation. Additionally, the HMAC authentication protecting the endpoint can be bypassed on fresh installations before the administrator visits the settings page, as the secret key is not yet generated, enabling attackers to compute valid tokens. The vulnerability has a high severity score of 7.5 CVSS v3.1.

CVE-2026-42949 is an authorization bypass vulnerability in the /api/runscript endpoint of Frangoteam's FUXA product version 1.3.2-2809. This flaw allows an unauthenticated attacker to execute privileged operations by sending a specially crafted HTTP request. The vulnerability has a medium severity rating with a CVSS score of 5.6.

CVE-2026-118426 is a missing authorization vulnerability in Octopus Deploy Octopus Server when the LDAP authentication provider is enabled. Authenticated users can call LDAP user and group search functions without proper authorization. This issue affects specific versions prior to fixed releases 2026.2.13487 and 2026.3.15909. The vulnerability has a medium severity with a CVSS score of 5.3.

An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.

A cross-site scripting (XSS) vulnerability exists in the addlist.php file of the Add Product Page component in configuroweb inventariobasico. The vulnerability arises from improper handling of the product name argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vulnerability has a low CVSS score of 3.5 and public exploit code is available. The project has been notified but has not yet responded or issued a fix.

Mattermost versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, and 11.7.x up to 11.7.10 contain a vulnerability in the Agents plugin's mention reminder component. This flaw allows an authenticated user with posting permissions in a channel visible to a system administrator to craft a post with a forged mention reminder. If the administrator clicks this mention, their browser sends an unintended API request that can replace an installed plugin, leading to remote code execution on the server.

python-markdown2 versions through 2.5.5 have a denial of service vulnerability where remote attackers can cause excessive CPU usage by submitting Markdown with unclosed inline link destinations. This triggers repeated rescanning of the document, resulting in quadratic CPU consumption.

Dolibarr ERP CRM versions before 24.0.2 have a missing authorization vulnerability in the recruitment module. This flaw allows unauthenticated attackers to access unpublished draft job positions by manipulating the ref parameter. Sensitive information such as job titles, descriptions, salary budgets, and recruiter contact details can be disclosed. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-118589 is a vulnerability in nschloe meshio versions 5.3.0 through 5.3.5 affecting the VTK Reader component in the file meshio/_vtk_42.py. It involves uncontrolled memory allocation triggered by manipulation of the DIMENSIONS argument. The flaw can be exploited remotely without authentication. No patch or vendor response has been reported yet.

A vulnerability in maykinmedia's open-object API versions 2.4.3 to before 2.5.1, 3.0.0 to before 3.6.2, 4.0.0-rc.1 to before 4.0.2, and 4.1.0 to before 4.1.1 allows an API token scoped to read one ObjectType to access full versioned records of objects of other ObjectTypes via the history-detail endpoint. This bypasses authorization checks that normally restrict access, potentially exposing sensitive data such as citizen or case records in government deployments. The issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.

CVE-2026-118577 is a server-side request forgery (SSRF) vulnerability in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8. The flaw exists in an unknown function of the Request Forwarder component, allowing remote attackers to manipulate requests. Exploit code is publicly available, enabling potential remote exploitation. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

A critical vulnerability identified as CVE-2026-109618 affects the Octo Image Server component of METTLER TOLEDO products, specifically versions up to 5.0.10. The vulnerability involves a PHP2Shell issue, which could potentially allow unauthorized code execution. Although the product is typically deployed within internal networks and not exposed directly to the internet, updating the PHP package to version 8.2.35 is recommended to mitigate any potential risk and align with cybersecurity best practices.