CVE-2026-128424

Kroxylicious-authorizer-acl: kroxylicious: acl rule file regex escapes are stripped, broadening 'matching' authorization rules

A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching /…/` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\d` and `\w` lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Amq Streams

CVE-2026-126119

Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call

The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125912

WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress context despite not being a Network Administrator and being unable to install WP Ultimate CSV Importer WordPress plugin before 9.2 or edit files.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125711

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124833

Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload

The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124822

Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-115559

imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS

IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Python Python Software Foundation

Products

Cpython Cpython

CVE-2026-116081

Improper Certificate Validation Enables Man‑in‑the‑Middle Attack in Sleipnir Mobile

Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc. are vulnerable to improper certificate verification. A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Fenrir

Products

Sleipnir Mobile For Iphone Ipad Sleipnir Mobile For Iphone Ipad Black Edition

CVE-2026-124763

AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site (for example by changing its URL or active , or deactivating every Woocommerce Wishlist WordPress plugin through 1.1.0).

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124664

Mine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content Disclosure

The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126799

Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gotenberg Thecodingmachine

Products

Gotenberg Gotenberg

CVE-2026-127099

Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion

A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat Sssd

Products

Enterprise Linux Enterprise Linux Openshift and 3 more

CVE-2026-18379

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux

CVE-2026-123711

WPCOM Member < 1.8.3 - Unauthenticated Account Takeover via WeChat Login Code Brute-Force

The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attackers to brute-force a code issued to another user and log in as that user, including administrators, when WeChat official-account keyword login is enabled.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123670

Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning

The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123124

WooCommerce Vindi Pagamento <= 0.8.3 - Unauthenticated Stored XSS via 'code' Parameter

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway. The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123097

WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123093

WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121853

AppPresser < 5.0.0 - Unauthenticated Plugin and Theme Version Disclosure

The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser WordPress plugin before 5.0.0 and its .

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120407

Contact Form 7 < 6.2.5 - Editor+ Sensitive User Data Disclosure via Form Default Values

The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—