The Photo Engine WordPress plugin versions up to 6.5.8 lack proper authorization checks on a REST API route used to update post data. This vulnerability allows authenticated users with Author-level access or higher to modify titles, content, excerpts, and other fields of arbitrary posts, pages, and attachments, including those owned by other users. The issue is fixed in version 6.6.0.
The Frontend Dashboard WordPress plugin before version 3.0.5 and the ProfileGrid WordPress plugin before version 6.0.0.5 contain a vulnerability that allows unauthenticated users to store serialized PHP objects in user metadata. These objects are deserialized when a public profile is viewed, enabling PHP object injection that can lead to arbitrary file write and potential remote code execution.
An information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that results in leaking information. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability in the Two Factor Authentication WordPress plugin (before 1.17.0) and the All-In-One Security (AIOS) WordPress plugin (before 5.5.0) allows improper authentication. The flaw occurs because the plugins do not bind the two-factor authentication code to the account being authenticated. An attacker who knows a victim's password and has their own two-factor-enabled account can bypass the victim's second-factor check by using their own two-factor code, thereby gaining access to the victim's session.
The Appointment Booking Plugin for WordPress before version 5.7.6 contains a cross-site scripting (XSS) vulnerability. This flaw arises because several booking-form step content settings are not properly escaped before being rendered on the public booking form. High-privilege users, such as administrators, can exploit this to inject JavaScript code that executes in the browsers of visitors who load the form. On multisite installations where administrators lack the unfiltered_html capability, this vulnerability allows crossing a privilege boundary to unauthenticated visitors.
Node Version Manager (nvm) versions 0.31.2 through 0.40.5 contain an OS command injection vulnerability in the nvm_ls function. This occurs because version strings with '#' characters can prematurely close a sed address, allowing execution of arbitrary shell commands via GNU sed's 'e' command or BSD sed's 'w' and 'r' commands. This vulnerability can be triggered by attacker-controlled version strings passed to various nvm commands or environment variables, and is exploitable when at least one version is installed. Version 0.40.6 fixes this issue by filtering version patterns containing '#' or newlines before they reach the vulnerable sed command.
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish WordPress plugin versions up to 4.1.12 contains a SQL Injection vulnerability via the 'exclude_posts' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and query preparation. Additionally, the HMAC authentication protecting the endpoint can be bypassed on fresh installations before the administrator visits the settings page, as the secret key is not yet generated, enabling attackers to compute valid tokens. The vulnerability has a high severity score of 7.5 CVSS v3.1.
CVE-2026-118426 is a missing authorization vulnerability in Octopus Deploy Octopus Server when the LDAP authentication provider is enabled. Authenticated users can call LDAP user and group search functions without proper authorization. This issue affects specific versions prior to fixed releases 2026.2.13487 and 2026.3.15909. The vulnerability has a medium severity with a CVSS score of 5.3.
An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.
A weakness in nschloe meshio up to version 5.3.5 affects the VTK Reader component in the file meshio/_vtk_42.py. Manipulating the DIMENSIONS argument can cause uncontrolled memory allocation. The vulnerability can be exploited remotely and has a medium severity rating with a CVSS score of 5.3. The project has been informed but has not yet responded or issued a fix.
Dolibarr ERP CRM versions before 24.0.2 have a missing authorization vulnerability in the recruitment module. This flaw allows unauthenticated attackers to access unpublished draft job positions by manipulating the ref parameter. Sensitive information such as job titles, descriptions, salary budgets, and recruiter contact details can be disclosed. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-118577 is a server-side request forgery (SSRF) vulnerability in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8. The flaw exists in an unknown function of the Request Forwarder component, allowing remote attackers to manipulate requests. Exploit code is publicly available, enabling potential remote exploitation. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVE-2026-93851 is a path traversal vulnerability in Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, and 11.9.0 through 11.9.1. It affects the Agents plugin's mention reminder component, allowing an authenticated user with posting permissions in a channel visible to a system administrator to craft a malicious post. If the administrator clicks the forged mention reminder, it triggers an unintended API request that replaces an installed plugin and enables code execution on the server.
Coder versions before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 do not validate the audience claim of Google Cloud Engine (GCE) instance-identity JWTs at a specific API endpoint. This flaw allows attackers who obtain a valid identity token intended for another relying party to replay it and gain unauthorized access to a workspace agent's session token, which remains valid until the next workspace build. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
n8n versions before 1.123.85, 2.43.5, and 2.44.1 have an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can execute workflows in inline JSON mode, bypassing permission checks and potentially exfiltrating decrypted credentials to attacker-controlled servers.
A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes the SeaTable Trigger node's API token to be saved in error execution data. This occurs because failed poll requests store raw request headers, exposing the API token to users who can view workflow executions but do not have credential read access.
n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 improperly store credential secrets in execution error data for certain nodes. This exposure occurs when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users with permission to view workflow executions but without credential read access can extract sensitive secrets such as Git passwords or tokens, MongoDB passwords, and Google access tokens from the error data.