CVE-2026-63267

LFI and GET SSRF via calcext:data-mappings and csv provider

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

The Document Foundation

Products

Libreoffice

CVE-2026-19395

An empty <img> attribute value in styled text triggers a parser error that halts the device.

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qt Redhat

Products

Qt For Mcus Hummingbird

CVE-2026-59797

Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Http Server

CVE-2026-105289

feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Feelec-yishu

Products

Feelcrm-os

CVE-2026-105285

Totolink A3002MU QoS Rule formIpQoS stack-based overflow

A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A3002mu

CVE-2026-105069

WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104810

Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability

This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104809

Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104401

WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104388

WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103351

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103335

WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103084

WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-63045

Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Apache Http Server Http Server Hummingbird

CVE-2026-78371

File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104404

WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-5782

Reflected XSS in MRV Technology's TurkHotspot

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Loglama.net

Products

Turkhotspot

CVE-2026-103488

Missing Authorization Allows Self‑Add to Project Teams in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-103489

HTML Injection in VCS Command Failure Notifications in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-103490

Privileged Escalation via User Group Links in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack