🚨 CVE-2026-15906
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

🎖@cveNotify

🚨 CVE-2026-16078
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.

🎖@cveNotify

🚨 CVE-2026-64799
Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder.

🎖@cveNotify

🚨 CVE-2026-64872
Custom purge and log paths could escape the site webroot directory.

🎖@cveNotify

🚨 CVE-2026-64873
Custom query URLs could access internal or reserved network services.

🎖@cveNotify

🚨 CVE-2026-64874
CDN credentials were exposed in administrator request URLs.

🎖@cveNotify

🚨 CVE-2026-64875
GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.

🎖@cveNotify

🚨 CVE-2026-64876
Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.

🎖@cveNotify

🚨 CVE-2026-65430
MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.

🎖@cveNotify

🚨 CVE-2026-65431
Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.

🎖@cveNotify

🚨 CVE-2026-65712
CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata.

🎖@cveNotify

🚨 CVE-2026-65713
Modals gallery paths could enumerate unintended directories.

🎖@cveNotify

🚨 CVE-2026-65754
ReReplacer XML include paths could read files outside the site directory.

🎖@cveNotify

🚨 CVE-2026-65755
Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.

🎖@cveNotify

🚨 CVE-2026-65756
Shortcut configuration accepted arbitrary inline JavaScript.

🎖@cveNotify

🚨 CVE-2026-65757
The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

🎖@cveNotify

🚨 CVE-2026-65758
The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.

🎖@cveNotify

🚨 CVE-2026-8922
A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

🎖@cveNotify

🚨 CVE-2026-9149
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

🎖@cveNotify

🚨 CVE-2026-7886
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMessage` and `UpdateMessage` conversation controllers accept user-supplied file attachment IDs and load files directly via `$em->find(File::class, $attachmentID)` without checking per-file permissions (`canViewFile()`). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system.  The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won't be able to view the file.

🎖@cveNotify

🚨 CVE-2026-8237
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

🎖@cveNotify