missi vulnerabilities and threats

Transmission versions 4.0.0 up to but not including 4.1.3 have a permissive Cross-Origin Resource Sharing (CORS) vulnerability in the rpc-server.cc component. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read and replay the token to perform unauthorized RPC calls. Exploitation can lead to execution of script-torrent-done actions, changes to the download directory, or deletion of torrents and data.

CVE-2026-19041 is a command injection vulnerability in the MissionSquad mcp-api component, specifically in the function this.packageService.installPackage within src/controllers/packages.ts. This vulnerability affects versions up to 1.11.8 and allows remote attackers to execute arbitrary commands. The issue is resolved by upgrading to version 1.11.9.

CVE-2026-19040 is a server-side request forgery (SSRF) vulnerability in the MissionSquad mcp-api component up to version 1.11.9. The flaw exists in an unspecified function within the src/services/dcrClients.ts file. Remote attackers can exploit this vulnerability to perform SSRF attacks. The issue is resolved by upgrading to version 1.11.10.

Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute Force. This issue affects Mobile Application: from 1.6.2 before 1.13.

Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13.

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1.

Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse. This issue affects Web Fax: from 3.0 before 3.0.1

Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation.This issue affects Web Fax: from 3.0 before 3.0.1

Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse, Session Credential Falsification through Manipulation.This issue affects Web Fax: from 3.0 before 3.0.1

The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.