CVE-2026-62056

WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-9239

Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tigroumeow Wordpress-extensions

Products

Meow Gallery Meow Gallery

CVE-2026-94482

Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Vercel

Products

Next.js

CVE-2026-93471

Unbounded SAML message decompression in esaml allows memory exhaustion

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Arekinath Dropbox Handnot2

Products

Esaml Esaml Esaml

CVE-2026-92202

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Luxion

Products

Keyshot

CVE-2026-86696

Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Arekinath Dropbox Handnot2

Products

Esaml Esaml Esaml

CVE-2026-79868

Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79866

Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8

An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79865

Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10

A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-76529

Improper Protection of Alternate Path in Splunk SOAR

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76529 are related to improper protection of alternate path and are grouped under the Common Weakness Enumeration (CWE) CWE-424.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk

CVE-2026-76408

Improper Control of a Resource Through its Lifetime in Splunk SOAR

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76408 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk

CVE-2026-76012

Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Smub Wordpress-extensions

Products

Photo Gallery, Sliders, Proofing And Themes – Nextgen Gallery Nextgen Gallery

CVE-2026-62131

WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62016

WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62015

WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62014

WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62011

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62010

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62009

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62005

WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—