CVE-2026-129484

Kroki before 0.36.0 Reflected XSS via /goat/svg Color Scheme Options

Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129485

Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes

Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129468

Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line

Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line that allows restricted users to access domains outside their permissions. Restricted sub-users or single-domain logins can iterate the domain_id parameter to enumerate panel domain ids and read each domain's DNS line list and default line.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Netcccyun

Products

Dnsmgr

CVE-2026-129453

DrayTek Vigor2960 File Existence Check mainfunction.cgi check_file_exist heap-based overflow

A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed

Vendors

Draytek

Products

Vigor2960 Vigor2960 Firmware

CVE-2026-125765

WordPress ShortPixel Adaptive Images plugin <= 3.11.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Stored XSS.This issue affects ShortPixel Adaptive Images: from n/a through 3.11.6.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125795

WordPress Estatik plugin <= 4.3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through 4.3.6.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125793

WordPress Flexmls® IDX plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Reflected XSS.This issue affects Flexmls® IDX: from n/a through 4.1.2.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128893

WordPress Wise Chat plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Reflected XSS.This issue affects Wise Chat: from n/a through 3.4.5.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125799

WordPress Flow-Flow Social Stream plugin <= 5.0.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Looks Awesome Flow-Flow Social Stream flow-flow-social-streams allows Retrieve Embedded Sensitive Data.This issue affects Flow-Flow Social Stream: from n/a through 5.0.5.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125447

WordPress Kali Forms plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Reflected XSS.This issue affects Kali Forms: from n/a through 2.4.31.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125733

WordPress ShopLentor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Reflected XSS.This issue affects ShopLentor: from n/a through 3.5.7.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125771

WordPress MCP Server for WordPress plugin <= 2.0.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.3.

CVSS 3.1 · 7.2 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124747

Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size

A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue by returning crafted file size metadata, triggering a heap-based buffer overflow with attacker-controlled data. Successful exploitation may allow an attacker to execute arbitrary code or crash the application, resulting in a denial of service (DoS).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Busybox Red Hat Redhat

Products

Busybox Enterprise Linux Enterprise Linux and 3 more

CVE-2026-129469

Course-tencent-cloud before 2.0.2 IDOR via /api/refund/confirm

Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Xiaochong0302

Products

Course-tencent-cloud

CVE-2026-64478

ALSA: usb-audio: avoid kobject path lookup in DualSense match

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix. This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen(): RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation] The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-124561

D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow

A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-878 Dir-878

CVE-2026-124560

D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-878 Dir-878

CVE-2026-125780

WordPress Woocommerce Custom Product Addons Pro plugin <= 5.9.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This issue affects Woocommerce Custom Product Addons Pro: from n/a through 5.9.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125449

WordPress Testimonial Slider plugin <= 3.0.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase allows Object Injection.This issue affects Testimonial Slider: from n/a through 3.0.2.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124755

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allows Stored XSS.This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 6.1.4.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—