CVE-2026-60009

Unrestricted File Write via POST /file-upload in Eclipse Theia

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger the write with no preflight and no credentials, resulting in an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can write. This can escalate to remote code execution, for example by overwriting a startup-executed file such as `~/.bashrc`. Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Theia

CVE-2026-18881

TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress

Products

Tableon – Wordpress Posts Table Filterable Wordpress

CVE-2026-6079

Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ho3einie Wordpress

Products

Material Dashboard Wordpress

CVE-2026-7105

Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Xpro

Products

Wordpress Xpro Addons — 140+ Widgets For Elementor

CVE-2026-11977

WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step chain: an attacker first saves a crafted guest-author token via the wpma_metabox_authors_list parameter during post creation or editing, then triggers the injection when any admin user loads the post list screen at /wp-admin/edit.php, causing the injected SQL result to be rendered in the Authors column.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Afthemes Wordpress

Products

Wp Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Wordpress

CVE-2026-67200

Perspective 5.0.0 Path Traversal via cwd_static_file_handler

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials and application secrets, with results exposed cross-origin due to a wildcard Access-Control-Allow-Origin header set on all responses.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Perspective-dev

Products

Perspective

CVE-2026-59675

Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Rancher

CVE-2026-55998

Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Rancher

CVE-2026-7520

MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mailmunch Wordpress

Products

Mailmunch Forms For Mailchimp Wordpress

CVE-2026-11920

JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The affected admin page lacks nonce or CSRF protection on the GET request, meaning an unauthenticated attacker could exploit this vulnerability by tricking an authenticated administrator into issuing a crafted request. Additionally, the vulnerability is only triggered when the 'orderby' parameter is also present and non-empty alongside the 'order' parameter.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Beardev Wordpress

Products

Joomsport – For Sports: Team & League, Football, Hockey & More Wordpress

CVE-2026-14574

Prototype Pollution via Preference Merge in Eclipse Theia Settings

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) can pollute `Object.prototype` when the user opens the workspace, potentially altering application logic across the Theia process.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Theia

CVE-2026-0931

Denial-of-service vulnerability in M-Files Server

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

Server

CVE-2026-21548

Remote Denial of Service via Input Validation in Unisoc Modem

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

T8100 T8200 T8300 and 1 more

CVE-2026-21549

Improper Input Validation in Unisoc Modem Allows Remote Denial of Service

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

T8100 T8200 T8300 and 1 more

CVE-2026-21550

Remote Denial of Service via Improper Input Validation in Unisoc Modem Firmware

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

T8100 T8200 T8300 and 1 more

CVE-2026-21551

Unisoc Modem Denial of Service via Improper Input Validation

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

T8100 T8200 T8300 and 1 more

CVE-2026-21552

Improper Input Validation Leading to Remote Denial of Service in Unisoc Modem

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

T8100 T8200 T8300 and 1 more

CVE-2026-21553

Improper Input Validation in Unisoc Modem Leading to Remote Denial of Service

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

T8100 T8200 T8300 and 1 more

CVE-2026-21554

Improper Input Validation in Unisoc UDX710 Modem Leading to Remote Denial of Service

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

Udx710

CVE-2026-21555

Improper Input Validation in Unisoc UDX710 Modem Causing Remote Denial of Service

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

Udx710