CVE-2026-84706

Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in the execution environment

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside

CVE-2026-84499

Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside

CVE-2026-84096

WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Review Slider Pro

CVE-2026-84095

WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Review Slider Pro

CVE-2026-83964

Adobe Connect | Improper Certificate Validation (CWE-295)

Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Adobe Connect Android Mobile App Connect and 3 more

CVE-2026-82013

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Linux Microsoft

Products

Campaign Campaign Classic Linux Kernel and 1 more

CVE-2026-82003

Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)

Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe Linux Microsoft

Products

Campaign Campaign Classic Linux Kernel and 1 more

CVE-2026-81473

Improper Authorization in Dell Rugged Control Center Leading to Privilege Escalation

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Rugged Control Center

CVE-2026-78582

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-77203

Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode

The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Itthinx Wordpress-extensions

Products

Groups Groups

CVE-2026-76648

Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-75699

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 10 Critical EPSS 1.2% KEV · Not listed

Vendors

Adobe Linux Microsoft

Products

Campaign Campaign Classic Linux Kernel and 1 more

CVE-2026-75684

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Adobe Connect Android Mobile App Connect and 3 more

CVE-2026-72662

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-71461

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-71178

Non-Canonical URL Paths Allow Unauthorized Remote Access in Dell Secure Connect Gateway Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager

CVE-2026-56792

Improper Authorization in Dell Rugged Control Center Allows Local Privilege Escalation

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Rugged Control Center

CVE-2026-18143

Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed

Vendors

Addify Wordpress-extensions

Products

Request A Quote For Woocommerce Request A Quote For Woocommerce

CVE-2026-16591

WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Directory Kit

CVE-2026-15273

Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the Activity Log settings page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Automatic.css Wordpress-extensions

Products

Automatic.css Automatic.css