CVE-2026-9815

MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE

The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Magicform Wordpress

Products

Magicform Wordpress

CVE-2026-2021

Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute

The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, and including, 1.8.5. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Contrid Wordpress

Products

Slideshow Gallery Lite Wordpress

CVE-2026-56007

WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This issue affects Ocean Product Sharing: from n/a through 2.2.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oceanwp Wordpress

Products

Ocean Product Sharing Wordpress

CVE-2026-44942

libzypp .repo files can have an optional path which can lead to path traversal attacks

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Libzypp

CVE-2026-9158

Use‑After‑Free via DELETE Connection in Eclipse 4diac FORTE Management Interface

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

4diac 4diac Forte

CVE-2026-47833

Container-to-host privilege escalation via symlink in Cloud Foundry BPM setupBpmLogs

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job. Affected versions: bpm-release, all versions prior to v1.4.30.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Bpm-release

CVE-2026-51844

Stack Buffer Overflow in Tenda AC7 Router 'AdvSetMacMtuWan' Interface

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

Ac7 Ac7 Firmware

CVE-2026-1856

Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom booking field labels in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Creavi Wordpress

Products

Creavi Appointment Booking Calendar Wordpress

CVE-2026-10720

MicroCeph path traversal issue in the remote-import API

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical

Products

Microceph

CVE-2026-12644

Uncaught Exception in ts-deepmerge from Improper Handling of Object.prototype Methods

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Voodoocreation

Products

Ts-deepmerge

CVE-2026-9822

WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Hotel Booking

Products

Wordpress Wp Hotel Booking

CVE-2026-47341

Apache APISIX: Session replay issue in hmac-auth

Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2016-20092

NetDrive 2.6.12 Unquoted Service Path Elevation of Privilege

NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that will be executed during service startup or system reboot, resulting in privilege escalation.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Netdrive

Products

Netdrive

CVE-2020-37250

TFTP Broadband 4.3.0.1465 Unquoted Service Path Privilege Escalation

TFTP Broadband 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code with system privileges. Attackers can place a malicious executable in the Program Files directory path that will be executed during service startup or system reboot with LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Weird-solutions

Products

Tftp Broadband

CVE-2026-12726

Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template's webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform Awx

CVE-2026-10530

Pie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token

The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pie Register Wordpress

Products

Pie Register Wordpress

CVE-2026-4110

Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ultimate-woocommerce-auction-pro Wordpress

Products

Ultimate-woocommerce-auction-pro Wordpress

CVE-2026-4259

Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ultimate-woocommerce-auction-pro Wordpress

Products

Ultimate-woocommerce-auction-pro Wordpress

CVE-2026-7859

Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media

The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such as the gallery, featured image and, on WooCommerce sites, product prices.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Motors Wordpress

Products

Motors Wordpress

CVE-2026-8157

Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Vitepos Wordpress

Products

Vitepos Wordpress