CVE-2026-46593

Authenticated SQL Injection in PHP Poll Script

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Php Jabbers

Products

Php Poll Script

CVE-2026-18481

Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Aws Ops Wheel

CVE-2025-67651

CSRF in PHP Jabbers scripts

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Php Jabbers

Products

Appointment Scheduler Auto Classifieds Script Availability Booking Calendar and 32 more

CVE-2025-67650

Authenticated SQL Injection in PHP Jabbers scripts

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Php Jabbers

Products

Appointment Scheduler Auto Classifieds Script Availability Booking Calendar and 32 more

CVE-2026-46594

Reflected XSS in PHP Poll Script

A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Php Jabbers

Products

Php Poll Script

CVE-2026-15227

Missing Authorization Allows Editing of Foreign Reports

Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Checkmk

Products

Checkmk

CVE-2025-67649

Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Php Jabbers Phpjabbers

Products

Car Rental Script Car Rental Script

CVE-2026-10695

IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries

IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-14554

Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

—

Products

—

CVE-2026-14319

GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Givewp Wordpress

Products

Givewp Wordpress

CVE-2026-15657

foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foreup

Products

Foreup

CVE-2026-15976

CVE-2026-15976

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-65835

Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Projectcapsule

Products

Capsule

CVE-2026-62323

Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudreve

Products

Cloudreve

CVE-2026-55495

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account. This issue is fixed in version 4.17.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudreve

Products

Cloudreve

CVE-2026-14483

Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed

Vendors

Realtyna Wordpress

Products

Realtyna Organic Idx Plugin + Wpl Real Estate Wordpress

CVE-2026-15974

CVE-2026-15974

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-63033

MZ Automation lib60870 Out-of-bounds Read

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mz-automation

Products

Lib60870

CVE-2026-66369

MZ Automation libiec61850 Out-of-bounds Read

The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap out-of-bounds read. On affected platforms, this condition reliably terminates the subscriber process and causes a denial-of-service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mz-automation

Products

Libiec61850

CVE-2026-61526

AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Adonisjs

Products

Http-server