CVE-2026-44054

Predictable afpd session token

Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4406

XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Kc Group E-commerce Software Project

Products

Kc Group E-commerce Software

CVE-2026-44074

Bitwise OR of errno values

Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultaneously, which may allow a remote attacker to cause a minor service disruption via conditions that trigger incorrect error-handling paths.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4530

SQLi in Turna Media's Advertising Administration Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL Injection. This issue affects Advertising Administration Panel: before 1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Turnatasarim

Products

Advertising Administration Panel

CVE-2026-44055

Bitwise OR logic bug enables shell injection

A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4531

SQLi in Mestavs E-commerce Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mestav

Products

E-commerce Software

CVE-2023-4541

SQLi in Weens Admin Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ween

Products

Management Panel

CVE-2023-4661

SQLi in Saphira Connect

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection. This issue affects Saphira Connect: before 9.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Adobe

Products

Connect

CVE-2026-4811

WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field

The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Class' category field in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpbean

Products

Wordpress Wpb Floating Menu Or Categories – Sticky Floating Side Menu & Categories With Icons

CVE-2023-4662

RCE in Saphira Connect

Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Adobe

Products

Connect

CVE-2026-44056

Stack buffer overflow in desktop.c

A stack-based buffer overflow in desktop.c in Netatalk 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44058

Authentication bypass via admin auth user

An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44059

Non-reentrant privilege toggle

A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause a minor service disruption.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4663

XSS in Saphira Connect

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affects Saphira Connect: before 9.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Connect

CVE-2023-4664

Privilage Escalation in Saphira Connect

Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Adobe

Products

Connect

CVE-2026-44073

seteuid failure ignored in auth modules

Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4665

Privilage Escalation in Saphira Connect

Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Adobe

Products

Connect

CVE-2026-40092

nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Nimiq

Products

Core-rs-albatross

CVE-2026-6279

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards (`[fusion_post_cards]`) or Table of Contents (`[fusion_table_of_contents]`) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.

CVSS 3.1 · 9.8 Critical EPSS 9.9% KEV · Not listed

Vendors

Themefusion Wordpress

Products

Fusion Builder Wordpress

CVE-2026-40094

nimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addresses

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerContact updates from untrusted peers and stores them in a peer contact book, eventually leading to address book crash. A PeerContact can legally contain an empty addresses list (no intrinsic validation enforces non-empty). Later, PeerContactBook::known_peers builds an address book by taking addresses.first().expect("every peer should have at least one address"). If the attacker has inserted a signed peer contact with addresses=[], any call to get_address_book (RPC/web client) can panic and crash the node/RPC task depending on panic settings. This issue has been fixed in version 1.4.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nimiq

Products

Core-rs-albatross