CVE-2026-100737

Unauthorized Firmware Upgrade in Atsumi Electric DVRs

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Atsumi Electric

Products

Adx1004 Adx1008 Adx2016 and 7 more

CVE-2026-97627

Remote Code Execution via Hidden Administrator Functionality in Atsumi DVRs

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Atsumi Electric

Products

Adx1004 Adx1008 Adx2016 and 7 more

CVE-2026-93300

EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eventon Wordpress-extensions

Products

Eventon - Subscriber Eventon

CVE-2026-96902

Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Easy Property Listings

CVE-2026-96903

Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Easy Property Listings

CVE-2026-113402

ArmorX Global Technology｜ArmorX Spam - Local File Inclusion

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Armorx Global Technology

Products

Armorx Spam

CVE-2026-112070

Broken Access Control in extension "Analytics" (analytics)

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Analytics

CVE-2026-113459

Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Ai Integration Extension

CVE-2026-112239

Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Ai Integration Extension

CVE-2026-113468

Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Shop By Coding.ms

CVE-2026-112071

Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Shop By Coding.ms

CVE-2026-113442

Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Fluid-form By Coding.ms

CVE-2026-112240

Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Fluid-form By Coding.ms

CVE-2026-112237

Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Kitodo.presentation

CVE-2026-112068

Insecure Direct Object Reference in extension "Analytics" (analytics)

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Analytics

CVE-2026-112066

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Sgalinski Cookie Consent

CVE-2026-112064

SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Sgalinski Cookie Consent

CVE-2026-112065

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Sgalinski Cookie Consent

CVE-2026-112069

Broken Access Control in extension "FAL Protect" (fal_protect)

The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Fal Protect

CVE-2026-113357

@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Tester-army

Products

E2e