CVE-2026-120574

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Surecart Wordpress-extensions

Products

Surecart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments Surecart

CVE-2026-120534

Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120524

News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen accessible to Subscribers (such as /wp-admin/profile.php), and because sanitize_text_field() is applied to the raw JSON string before json_decode(), allowing angle brackets encoded as \u003c/\u003e to survive sanitization and be restored to literal angle brackets, enabling overwrite of _elementor_data on any post.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120333

Broken Access Control in extension "Frontend User Registration" (sf_register)

The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "frontend User Registration"

CVE-2026-120332

Cross-Site Scripting in extension "Mail" (mail)

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120331

Server-Side Request Forgery in extension "Mail" (mail)

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120330

Broken Access Control in extension "Mail" (mail)

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120329

Broken Access Control in extension "Mail" (mail)

Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120328

Information Disclosure in extension "Mail" (mail)

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120327

Open Redirection in extension "Mail" (mail)

The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-119740

Nexbox A95X Amlogic S905X UART Unauthenticated Console Access

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Nexbox

Products

A95x

CVE-2026-119736

Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Petpooja

Products

Munshi

CVE-2026-119732

Munshi Broken Object Level Authorization via Invoice Deletion API

Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Petpooja

Products

Munshi

CVE-2026-119179

MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data

A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-119166

Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Uscnanbu Wordpress-extensions

Products

Welcart E-commerce Welcart E-commerce

CVE-2026-118489

CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse Eclipse Foundation

Products

Vert.x Vert.x

CVE-2026-118448

Uninitialized output buffer returned after nd_to_text failure in pybddisasm

A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitdefender

Products

Pybddisasm

CVE-2026-118447

Uninitialized INSTRUX contents returned after decoding failure in pybddisasm

A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bitdefender

Products

Pybddisasm

CVE-2026-118446

Use-after-free in INSTRUX array members in pybddisasm

A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitdefender

Products

Pybddisasm

CVE-2026-118445

Use-after-free in INSTRUX structure members in pybddisasm

A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation alive. Accessing the member after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the member is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access a member reference after the parent object has been freed. The pybddisasm package is no longer maintained.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitdefender

Products

Pybddisasm