CVE-2026-15537

SourceCodester Online Book Store System login.php sql injection

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Online Book Store System

CVE-2026-15543

Tenda CH22 CertListInfo formCertListInfo buffer overflow

A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument Name results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

Ch22 Ch22 Firmware

CVE-2026-15557

waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Waooai

Products

Waoowaoo

CVE-2026-55810

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal Plotly

Products

Plotly.js Graphing Plotly.js Graphing

CVE-2025-15608

Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax53 Archer Ax53 Firmware Ax53 V1

CVE-2026-56666

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim's local account. This issue is fixed in version 4.15.3.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Zitadel

Products

Zitadel

CVE-2026-13233

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Drupal Openai Provider Project

Products

Openai Provider Openai Provider

CVE-2026-13235

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Artificial Intelligence Project Drupal

Products

Artificial Intelligence Artificial Intelligence

CVE-2026-58493

grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values. This issue is fixed in version 1.2.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-13236

AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Artificial Intelligence Project Drupal

Products

Artificial Intelligence Ai Agents

CVE-2026-57584

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Phalcon

Products

Cphalcon

CVE-2026-13232

Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052

Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Anuaralfetahe Drupal

Products

Advanced Content Feedback Advanced Content Feedback (aka Admin Feedback)

CVE-2026-13241

Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Md-systems

Products

Paragraphs Paragraphs

CVE-2026-13240

Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Md-systems

Products

Paragraphs Paragraphs

CVE-2026-54736

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first differing byte. This observable timing discrepancy can allow an attacker to recover a valid tag byte-by-byte and attach it to a chosen IV and ciphertext so that decrypt() accepts tampered encrypted content as authentic. This issue is fixed in version 5.14.1.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Phalcon

Products

Cphalcon

CVE-2026-13239

WissKI - Critical - Access bypass - SA-CONTRIB-2026-059

Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Wiss-ki

Products

Wisski Wisski

CVE-2026-15494

AMTT Hotel Broadband Operation System switch_status.php sql injection

A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Amtt Amttgroup

Products

Hotel Broadband Operation System Hotel Broadband Operation System

CVE-2026-41482

Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Frappe

CVE-2026-13244

Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Dakku Drupal

Products

Tealium Iq Tag Management Tealium Iq Tag Management

CVE-2026-13243

Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Victorkane

Products

Salesforce Suite Salesforce Suite