CVE-2026-63436

zt-zip: Path traversal in fluent API unpack

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zeroturnaround

Products

Zt-zip

CVE-2026-63417

Logging Redactor: PII data in str/repr of non primitive objects was not being redacted

Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Armurox

Products

Logging Redactor

CVE-2026-54863

WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mamunur Rashid Wordpress-extensions

Products

Review Schema Review Schema

CVE-2026-45146

Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Chamilo

Products

Chamilo Lms

CVE-2026-44265

Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Enspirit

Products

Elo

CVE-2026-123476

WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Stored XSS.This issue affects Featured Image from URL: from n/a through 6.1.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123475

WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pt Norther Lights Production Wordpress-extensions

Products

Mapsvg Mapsvg

CVE-2026-123463

WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.4.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123460

WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nickboss Wordpress-extensions

Products

Wordpress File Upload Wordpress File Upload

CVE-2026-122666

WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.This issue affects Mang Board WP: from n/a through 2.4.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-122665

WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Stored XSS.This issue affects Mang Board WP: from n/a through 2.4.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-122661

WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpwax

Products

Directorist Directorist

CVE-2026-121782

WordPress If-So Dynamic Content Personalization plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121763

WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121735

blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Blueprintue

Products

Blueprintue-self-hosted-edition

CVE-2026-121731

RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rosariosis

Products

Rosariosis

CVE-2026-121727

Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jorisvink

Products

Kore

CVE-2026-121722

WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract Automation: from n/a through 2.0.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121631

Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Lightdash

Products

Lightdash

CVE-2026-121627

buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jarun

Products

Buku