CVE-2026-4061

Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb->prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cyberhobo Wordpress

Products

Geo Mashup Wordpress

CVE-2026-7612

itsourcecode Courier Management System edit_user.php sql injection

A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Courier Management System

CVE-2026-7638

App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the `upload_avatar()` function, which accepts an attacker-controlled `user_id` parameter from the POST request body and uses it to update user meta without verifying that the authenticated requester owns or has permission to modify the target account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the profile avatar of any arbitrary user on the site, including administrators, by supplying a target `user_id` in the request body to the `/wp-json/app-builder/v1/upload-avatar` endpoint.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Appcheap Wordpress

Products

App Builder – Create Native Android & Ios Apps On The Flight Wordpress

CVE-2026-7685

Edimax BR-6208AC setWAN buffer overflow

A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of the file /goform/setWAN. Performing a manipulation of the argument pptpDfGateway  results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Edimax

Products

Br-6208ac Br-6208ac Firmware

CVE-2026-5113

Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. This is due to a flawed state validation mechanism that fails open when input is sanitized by wp_kses(), combined with insufficient output escaping. The state validation logic creates two hashes (raw input and wp_kses-sanitized input) and only fails validation if BOTH hashes don't match the original state. When an attacker injects XSS payloads using tags stripped by wp_kses() (like <svg>), the sanitized hash matches while the malicious raw value is preserved and saved to the database. When administrators view the Entries List page, the stored malicious consent label is retrieved and output without escaping, causing the XSS payload to execute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entries that will execute whenever an authenticated administrator accesses the entries list page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Gravityforms Wordpress

Products

Gravity Forms Wordpress

CVE-2026-22740

Spring Framework DoS with Multipart Temp Files in WebFlux

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vmware

Products

Spring Framework

CVE-2026-34264

Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Erp Human Capital Management Human Capital Management S\/4hana

CVE-2026-22741

Static resource cache poisoning in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Vmware

Products

Spring Framework

CVE-2026-22745

CVE-2026-22745 : Denial of service in static resource handling on Windows platforms

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is serving static resources from the file system * the application is running on a Windows platform When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Vmware

Products

Windows Spring Framework

CVE-2026-4024

Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification

The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wpr_update_form_action_meta` AJAX action in all versions up to, and including, 1.7.1056. The handler is registered on both `wp_ajax` and `wp_ajax_nopriv` hooks, making it accessible to unauthenticated users. Although a nonce is verified, the nonce (`wpr-addons-js`) is publicly exposed in frontend JavaScript via `WprConfig.nonce` on any page that loads Royal Addons widgets, rendering the protection ineffective. The endpoint also lacks any capability or ownership checks and directly calls `update_post_meta()` with user-controlled input on a whitelisted set of form action meta keys. This makes it possible for unauthenticated attackers to modify form action configuration metadata (email, submissions, Mailchimp, and webhook settings) on any post, potentially leading to webhook/email action tampering and data exfiltration via modified webhook URLs.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wproyal

Products

Wordpress Royal Addons For Elementor – Addons And Templates Kit For Elementor

CVE-2026-32650

Anviz CrossChex Standard Algorithm Downgrade

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Crosschex Standard Crosschex Standard

CVE-2026-40434

Anviz CrossChex Standard Improper Verification of Source of a Communication Channel

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Crosschex Standard Crosschex Standard

CVE-2026-24178

Unauthenticated Authorization Bypass via User‑Controlled Key in NVIDIA FLARE Dashboard

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Linux Nvidia

Products

Macos Linux Kernel Flare Sdk and 1 more

CVE-2026-24186

Deserialization of Untrusted Data in NVIDIA FLARE SDK FOBS Leading to Code Execution

NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Nvidia

Products

Macos Linux Kernel Flare Sdk and 1 more

CVE-2026-24204

Improper Input Validation in NVIDIA Flare SDK Leading to Path Traversal and Information Disclosure

NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. A successful exploit of this vulnerability may lead to information disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Linux Nvidia

Products

Macos Linux Kernel Flare Sdk and 1 more

CVE-2026-34262

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Hana Cockpit Hana Database Explorer

CVE-2026-32324

Anviz CX7 Firmware Use of Hard-coded Cryptographic Key

Anviz CX7 Firmware is  vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx7 Firmware Cx7 Cx7 Firmware

CVE-2026-32648

Anviz Products Missing Authorization

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx2 Lite Firmware Anviz Cx7 Firmware Cx2 Lite and 3 more

CVE-2026-33093

Anviz Products Missing Authorization

Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx7 Firmware Cx7 Cx7 Firmware

CVE-2026-33569

Anviz Products Cleartext Transmission of Sensitive Information

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx2 Lite Firmware Anviz Cx7 Firmware Cx2 Lite and 3 more