CVE-2026-18051The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name.
On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
CVE-2026-63660node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.
CVE-2026-126571
Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulne
Nov 11
4.8
CVE-2026-126570Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerabNov 117.6
CVE-2026-126569Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vNov 115.4
CVE-2026-126567Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-sitNov 115.4
CVE-2026-126566Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authoNov 117.1
CVE-2026-126565Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of servicNov 114.3
CVE-2026-126564Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-sitNov 115.4
CVE-2026-126563Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-Nov 116.1
CVE-2026-126562Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled reNov 114.3
2
CVE-2026-61564
AVideo is a video-sharing Platform. Prior to 8.1.0
10.0
3CVE-2025-60207Unrestricted Upload of File with Dangerous Type vu
10.0
4CVE-2026-93741A security flaw has been discovered in Totolink A3
10.0
5CVE-2026-92953vm2 versions from 3.11.0 before 3.11.8 fail to pro
10.0
6CVE-2026-61732Decepticon is an autonomous hacking agent for red
10.0
7CVE-2026-75699Adobe Campaign Classic (ACC) is affected by an Imp
10.0
8CVE-2000-1241Unspecified vulnerability in Haakon Nilsen simple,
10.0
9CVE-2026-42696Improper Control of Generation of Code ('Code Inje
10.0
10CVE-2026-48276ColdFusion versions 2025.9, 2023.20 and earlier ar
10.0
11CVE-2026-25470Unauthenticated Remote Code Execution (RCE) in ACP
CVE-2026-61564AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.
CRITICAL
10.0
NVDCWE-94
No
Oct 28, 2026
CVE-2025-60207Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
CRITICAL
10.0
NVDCWE-434
No
Nov 6, 2025
CVE-2026-93741A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CRITICAL
10.0
NVDCWE-119
No
Sep 19, 2026
CVE-2026-92953vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.
CRITICAL
10.0
NVDCWE-913
No
Sep 17, 2026
CVE-2026-61732Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.
CRITICAL
10.0
NVDCWE-74
No
Sep 24, 2026
CVE-2026-75699Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CRITICAL
10.0
NVDCWE-94
No
Sep 22, 2026
CVE-2000-1241Unspecified vulnerability in Haakon Nilsen simple, integrated publishing system (SIPS) before 0.2.4 has an unknown impact and attack vectors, related to a "grave security fault."
HIGH
10.0
NVD
No
Dec 31, 2000
CVE-2026-42696Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19.
CRITICAL
10.0
NVDCWE-94
No
Oct 10, 2026
CVE-2026-48276ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
CRITICAL
10.0
NVDCWE-434
No
Jun 30, 2026
CVE-2026-25470Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 versions.
CRITICAL
10.0
NVDCWE-94
No
Jun 17, 2026
CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
CRITICAL
10.0
NVDCWE-918
Yes
Jul 14, 2026
HIGH
8.1
NVDCWE-190
No
Nov 11, 2026
CVE-2026-63194OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.
N/A
N/A
NVDCWE-22
No
Nov 11, 2026
CVE-2026-63192OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1.
N/A
N/A
NVDCWE-89
No
Nov 11, 2026
CVE-2026-126571Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.
MEDIUM
4.8
NVDCWE-307
No
Nov 11, 2026
CVE-2026-126570Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.
HIGH
7.6
NVDCWE-1321
No
Nov 11, 2026
CVE-2026-126569Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.
MEDIUM
5.4
NVDCWE-79
No
Nov 11, 2026
CVE-2026-126567Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session.
MEDIUM
5.4
NVDCWE-79
No
Nov 11, 2026
CVE-2026-126566Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit and move protection logged under the administrator's name.
HIGH
7.1
NVDCWE-863
No
Nov 11, 2026
CVE-2026-126565Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages that fan out, so queries via concept page views, Special:Ask, or api.php action=ask exhaust CPU and memory.
MEDIUM
4.3
NVDCWE-407
No
Nov 11, 2026
CVE-2026-126564Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API.
MEDIUM
5.4
NVDCWE-79
No
Nov 11, 2026
CVE-2026-126563Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session.
MEDIUM
6.1
NVDCWE-79
No
Nov 11, 2026
CVE-2026-126562Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views, Special:Ask, or api.php action=ask queries to exhaust PHP memory or stack.