CVE-2026-111831

WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmanageninja

Products

Fluentform Fluent Forms

CVE-2026-111845

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Yithemes

Products

Yith Woocommerce Product Bundles Yith Woocommerce Product Bundles

CVE-2026-110008

@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive their own authorization flow in the victim's browser and sign the victim in to the attacker's account (login CSRF). The issue is fixed in @fastify/oauth2 8.3.2, and users should upgrade to 8.3.2 or later. As a workaround, set an explicit cookie path so the set and the clear name the same cookie.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Fastify

Products

Fastify/oauth2

CVE-2026-110902

WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Liquid Web / Stellarwp Wordpress-extensions

Products

Event Tickets Event Tickets

CVE-2026-112222

WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Surfer Wordpress-extensions

Products

Surfer Surfer

CVE-2026-111828

WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mamunur Rashid Wordpress-extensions

Products

Classified Listing Classified Listing

CVE-2026-112262

RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Risingwavelabs

Products

Risingwave

CVE-2026-112271

libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser

libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Emersion

Products

Libdisplay-info

CVE-2026-112272

libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser

Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Emersion

Products

Libdisplay-info

CVE-2026-112274

libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Libtins

Products

Libtins

CVE-2026-112280

libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nkoriyama

Products

Aribb24

CVE-2026-112281

libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi

libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nkoriyama

Products

Aribb24

CVE-2026-112284

libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xqq

Products

Libaribcaption

CVE-2026-112289

Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Koalixswitzerland

Products

Koalixcrm

CVE-2026-112290

MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Mi6

Products

Intelligence Community Ui Kit Canary Web Components

CVE-2026-112291

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Flarum

Products

Extension Manager

CVE-2026-112292

CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Operacle

Products

Checkcle

CVE-2026-86375

Missing Encryption of Sensitive Data in Dell Application Installer

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Application Installer

CVE-2026-112303

GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gdevelop

Products

Gdevelop

CVE-2026-112308

crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Crewai Crewaiinc

Products

Crewai Crewai-tools