CVE-2026-110879 - jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
CVE ID :CVE-2026-110879
Published : Oct. 28, 2026, 1:16 a.m. | 52 minutes ago
Description :jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map accepts HashMap; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110879
Published : Oct. 28, 2026, 1:16 a.m. | 52 minutes ago
Description :jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map accepts HashMap; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118271 - a2ui-project a2ui data-context Resolver data-context.ts resource consumption
CVE ID :CVE-2026-118271
Published : Oct. 28, 2026, 1:30 a.m. | 38 minutes ago
Description :A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is eb314e14fabd29cfb4a74e1202afc4fe2081efa2. Applying a patch is advised to resolve this issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118271
Published : Oct. 28, 2026, 1:30 a.m. | 38 minutes ago
Description :A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is eb314e14fabd29cfb4a74e1202afc4fe2081efa2. Applying a patch is advised to resolve this issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-106013 - Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
CVE ID :CVE-2026-106013
Published : Oct. 28, 2026, 1:30 a.m. | 38 minutes ago
Description :The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-106013
Published : Oct. 28, 2026, 1:30 a.m. | 38 minutes ago
Description :The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118274 - a2ui-project a2ui Binder generic-binder.ts resource consumption
CVE ID :CVE-2026-118274
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118274
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118370 - libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
CVE ID :CVE-2026-118370
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118370
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118371 - LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
CVE ID :CVE-2026-118371
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118371
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118372 - LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
CVE ID :CVE-2026-118372
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118372
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118373 - LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
CVE ID :CVE-2026-118373
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118373
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118374 - LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
CVE ID :CVE-2026-118374
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118374
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118375 - llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
CVE ID :CVE-2026-118375
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.
Severity: 9.2 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118375
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.
Severity: 9.2 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118376 - WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
CVE ID :CVE-2026-118376
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118376
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118377 - mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
CVE ID :CVE-2026-118377
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118377
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118378 - Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name
CVE ID :CVE-2026-118378
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118378
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118384 - GNU mtools Out-of-Bounds Write
CVE ID :CVE-2026-118384
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118384
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-84999 - Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
CVE ID :CVE-2026-84999
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-84999
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-97019 - AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
CVE ID :CVE-2026-97019
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-97019
Published : Oct. 28, 2026, 3:17 a.m. | 2 hours, 52 minutes ago
Description :The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-111255 - affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
CVE ID :CVE-2026-111255
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-111255
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-111727 - Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
CVE ID :CVE-2026-111727
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a per-user grant that any administrator can extend to users as low as Subscriber level through the plugin's calendar list screen. Exploitation by attackers with subscriber-level access and above requires that an administrator has assigned the attacker's account as owner (`conwer`) of a calendar via the plugin's calendar list screen; the plugin's UI lists all registered users regardless of role, so a Subscriber can be assigned. On a default installation, where that is not configured, the vulnerability requires attackers with editor-level access and above.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-111727
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a per-user grant that any administrator can extend to users as low as Subscriber level through the plugin's calendar list screen. Exploitation by attackers with subscriber-level access and above requires that an administrator has assigned the attacker's account as owner (`conwer`) of a calendar via the plugin's calendar list screen; the plugin's UI lists all registered users regardless of role, so a Subscriber can be assigned. On a default installation, where that is not configured, the vulnerability requires attackers with editor-level access and above.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-116613 - Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
CVE ID :CVE-2026-116613
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch, calling displayContent() with no capability check and no validation that the post's post_type is the plugin's own CPT or is otherwise viewable (is_post_type_viewable()). This makes it possible for authenticated attackers, with Contributor-level access and above, to read the rendered block content of any published post, including posts of non-public custom post types (public=false, show_in_rest=false) that WordPress would otherwise hide from direct URLs and the REST API.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-116613
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch, calling displayContent() with no capability check and no validation that the post's post_type is the plugin's own CPT or is otherwise viewable (is_post_type_viewable()). This makes it possible for authenticated attackers, with Contributor-level access and above, to read the rendered block content of any published post, including posts of non-public custom post types (public=false, show_in_rest=false) that WordPress would otherwise hide from direct URLs and the REST API.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118275 - a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
CVE ID :CVE-2026-118275
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118275
Published : Oct. 28, 2026, 4:17 a.m. | 1 hour, 52 minutes ago
Description :A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-118276 - a2ui-project a2ui Parser expression_parser.ts formatString resource consumption
CVE ID :CVE-2026-118276
Published : Oct. 28, 2026, 4:18 a.m. | 1 hour, 52 minutes ago
Description :A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.
Severity: 4.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-118276
Published : Oct. 28, 2026, 4:18 a.m. | 1 hour, 52 minutes ago
Description :A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.
Severity: 4.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...