What needs attention now.

Microsoft Entra ID Elevation of Privilege Vulnerability

• Microsoft Entra
• Server-side request forgery (SSRF)

Azure SQL Database Elevation of Privilege Vulnerability

• Microsoft Azure SQL Database
• SQL injection

Microsoft Exchange Online Elevation of Privilege Vulnerability

• Microsoft Exchange Online
• Server-side request forgery (SSRF)

Azure Data Factory Elevation of Privilege Vulnerability

• Microsoft Azure Data Factory
• Weak cryptography or TLS

CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

• cloudnative-pg
• CWE-426

Stack-based buffer overflow in Apple swift-nio-ssh

• Apple swift-nio-ssh
• Memory corruption

Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• CWE-441

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

• CWE-693

>=1.2.7, <1.2.13 · fixed in 1.2.13

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

• Authentication bypass

<2.20.1 · fixed in 2.20.1

Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

• TP-Link Systems Inc. ER7212PC v2
• TP-Link Systems Inc. ER605 v2
• Command injection

Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

• Red Hat Advanced Cluster Management for Kubernetes 2.16
• Red Hat Advanced Cluster Management for Kubernetes 2.17
• CWE-1104

Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow

• Comfast CF-N1-S
• Memory corruption

) Missing Server-Side File Extension Validation in vsDesk

• vsDesk
• Unrestricted file upload

Libevent: HTTP header handling bugs create risk of access control bypass.

• libevent
• HTTP request smuggling

libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

• libevent
• HTTP request smuggling

Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

• cesanta mongoose
• Weak cryptography or TLS

Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE

• cesanta mongoose
• HTTP request smuggling

Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification

• cesanta mongoose
• Weak cryptography or TLS

Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

• cesanta mongoose
• HTTP request smuggling

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

• Authentication bypass

<25.3.5 · fixed in 25.3.5

Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

• Authentication bypass

>=0.3.0 · no fixed version yet

Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow

• Comfast CF-N1-S
• Memory corruption

dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

• t8y2 dbx
• Authentication bypass

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability

• OSNEXUS QuantaStor
• Authentication bypass

Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

• Apache Software Foundation Apache InLong
• SQL injection

Apache InLong: SQL Injection via String Concatenation Vulnerability Report

• Apache Software Foundation Apache InLong
• SQL injection

Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

• Apache Software Foundation Apache InLong
• SQL injection

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Path traversal

Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

• Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS)
• Authentication bypass

WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability

• HashThemes Easy Elementor Addons
• Cross-site request forgery (CSRF)

CVE-2026-18482

• Klarso GmbH neo-mjs
• Command injection

WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability

• themagnifico52 Warehouse Cargo
• Unrestricted file upload

WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

• themagnifico52 Smart Cleaning
• Unrestricted file upload

WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

• indithemes IT Residence
• Unrestricted file upload

WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

• WPEverest User Registration & Membership Pro
• Authentication bypass

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

• Roxnor FundEngine
• Insecure deserialization

WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

• Jonathan Daggerhart Query Wrangler
• Code injection

WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

• Repute Infosystems BookingPress Appointment Booking Pro
• SQL injection

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability

• Tyche Softwares. Abandoned Cart Pro for WooCommerce
• Privilege escalation

WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability

• plainware Locatoraid Store Locator
• SQL injection

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

• Monkeysan Flatastic
• Insecure deserialization

WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

• e-plugins Directory Pro
• SQL injection

WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

• CodexThemes TheGem (Elementor)
• SQL injection

WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

• David Lingren Media LIbrary Assistant
• Unrestricted file upload

WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability

• CleanTalk Inc Security & Malware scan by CleanTalk
• SQL injection

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability

• rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress
• SQL injection

WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

• WPMU DEV Forminator
• Insecure deserialization

WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability

• ThemeGoods Capella
• Privilege escalation

WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

• ThemeGoods Capella
• SQL injection

Paths or symlinks ending in a slash escape the sandbox

>=0.0.0-0, <3.4.6 || >=4.0.0, <4.0.3 · fixed in 3.4.6, 4.0.3

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Privilege escalation

Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic

• Frauscher Sensortechnik FDS 102
• Authentication bypass

JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update

• JSON Options
• Privilege escalation

TRENDnet TEW-755AP ssi wan.cgi stack-based overflow

• TRENDnet TEW-755AP
• Memory corruption

LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

• InternLM lmdeploy
• Insecure deserialization

Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

• Splunk MCP Server app
• Insecure deserialization

Improper Access Control through Embedded Reports in Splunk Enterprise

• Splunk Enterprise
• Broken access control

Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

• Splunk Enterprise
• Broken access control

Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

• Splunk Enterprise
• Broken access control

TRENDnet TEW-755AP mycli FUN_401000 stack-based overflow

• TRENDnet TEW-755AP
• Memory corruption