🔓 WordPress WPAdverts Authorization Bypass Exposes Site Configuration
Operators running WPAdverts 2.3.2 or earlier should patch promptly when a fixed release is available and restrict access to the affected endpoint in the meantime. Because no authentication is required, internet-facing WordPress sites deserve prompt attention.
CVE-2026-11801 affects the WPAdverts – Classifieds Plugin for WordPress through version 2.3.2 and allows unauthenticated attackers to retrieve internal configuration data through the classifieds-types REST endpoint. Exposed information can include post types, taxonomies, form metadata, contact options, and custom field meta keys. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
💥 COMFAST Router Flaw Enables Remote OS Command Injection
Anyone operating COMFAST CF-N1-S 2.6.0.1 should treat this as urgent, especially if the management interface is remotely accessible. Apply vendor remediation when available and restrict CGI administration exposure immediately; the published exploit lowers the barrier to attacks.
CVE-2026-75094 is an OS command injection vulnerability in the CGI interface of COMFAST CF-N1-S 2.6.0.1. Manipulating the ssid argument in /cgi-bin/mbox-config?method=SET§ion=ptest_ssid can permit remote exploitation. The vulnerability is rated CRITICAL with CVSS 9.1, and an exploit has been published and may be used.
🔗 Read more 🔗
Source: NVD
🧪 PHPGurukul Complaint System Hit by Remote SQL Injection
Deployments of PHPGurukul Complaint Management System 1.0 should be patched or isolated promptly. Because public exploit material is available and the vulnerable endpoint is remotely reachable, administrators should also review web and database logs for suspicious requests.
CVE-2026-75089 affects PHPGurukul Complaint Management System 1.0 and allows SQL injection through the email argument handled by user/check_availability.php. The attack can be performed remotely. The vulnerability is rated HIGH with CVSS 7.3, and the exploit has been made publicly available.
🔗 Read more 🔗
Source: NVD
🗄️ SourceCodester Timetabling System Exposes SQL Injection Flaw
Administrators running this SourceCodester application should patch, replace, or restrict access to the vulnerable endpoint without delay. Public exploit availability makes exposed installations particularly easy targets.
CVE-2026-75080 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. Remote attackers can manipulate the ID argument processed by /edit_subject1.php to trigger SQL injection. The issue is rated HIGH with CVSS 7.3, and the exploit has been disclosed publicly and may be used.
🔗 Read more 🔗
Source: NVD
🗄️ Second SourceCodester Timetabling Endpoint Vulnerable to SQL Injection
Users of SourceCodester Class and Exam Timetabling System 1.0 should address this alongside related SQL injection flaws in the product. Internet-facing deployments need prompt remediation because public exploit material is already available.
CVE-2026-75079 affects SourceCodester Class and Exam Timetabling System 1.0 and permits SQL injection through the ID argument in /edit_subject2.php. The vulnerability can be exploited remotely. It is rated HIGH with CVSS 7.3, and the exploit has been made publicly available and could be used for attacks.
🔗 Read more 🔗
Source: NVD
👑 Mattermost Boards Flaw Lets Users Grant Arbitrary Admin Rights
Mattermost administrators on the affected release branches should prioritize upgrading to a fixed version. This is a privilege-escalation issue requiring an existing user context, so organizations with broad internal membership or sensitive Boards should move especially quickly.
CVE-2026-9816 affects Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3. Missing server-side validation of BoardMember.Scheme fields allows a board editor or non-guest team member to grant board administrator privileges to arbitrary users through board membership and archive-import APIs. The vulnerability is rated HIGH with CVSS 8.3.
🔗 Read more 🔗
Source: NVD
🔑 Critical Onyx Flaw Leaks Other Users’ OAuth Authorization Headers
Onyx operators should upgrade immediately to 3.1.10, 3.2.14, 4.0.0, or a later supported release. Because OAuth credentials belonging to other users may be exposed, consider rotating potentially affected tokens after patching and reviewing access logs for suspicious MCP API queries.
CVE-2026-71424 affects the Onyx AI platform before versions 3.1.10, 3.2.14, and 4.0.0. Shared MCP connection configuration can cause per-user OAuth Authorization headers to be exposed through MCP server API responses to any BASIC_ACCESS user. The vulnerability is rated CRITICAL with CVSS 9.6 and is fixed in versions 3.1.10, 3.2.14, and 4.0.0.
🔗 Read more 🔗
Source: NVD
📂 MLflow Access-Control Flaw Exposes Other Users’ Model Artifacts
MLflow installations with multiple users or tenants should upgrade to 3.15.0 or later promptly. The attack requires authentication, but the cross-user data exposure makes this important for shared research, production ML, and hosted environments.
CVE-2026-69148 affects MLflow before version 3.15.0. Authenticated users can create a model version referencing another user’s artifact directory and then retrieve files through GET /model-versions/get-artifact without the required READ permission. The vulnerability is rated HIGH with CVSS 7.1 and is fixed in version 3.15.0.
🔗 Read more 🔗
Source: NVD
🌐 Critical MLflow Webhook SSRF Can Reach Internal and Cloud Metadata Services
Internet-accessible MLflow deployments should upgrade to 3.15.0 or later immediately. The combination of unauthenticated access, SSRF, redirect handling, and potential cloud metadata exposure makes this a high-priority patch for hosted and cloud environments.
CVE-2026-64849 is an SSRF vulnerability affecting MLflow before version 3.15.0. The unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint validates only the original URL, while redirects can be followed and hostnames re-resolved, allowing attackers to reach internal systems or cloud metadata services and receive response_status and response_body. The vulnerability is rated CRITICAL with CVSS 9.3 and is fixed in version 3.15.0.
🔗 Read more 🔗
Source: NVD
🔎 9Router OIDC Test Endpoint Enables Unauthenticated Internal Network Scanning
9Router users on 0.5.4 or earlier should restrict access to the dashboard and OIDC test functionality and install a fixed release when available. Deployments with dashboard login disabled are the most exposed and should be treated as urgent.
CVE-2026-56677 affects 9Router 0.5.4 and earlier. When dashboard login is disabled, unauthenticated attackers can supply a private or loopback issuerUrl to the OIDC test endpoint, allowing internal service scanning and disclosure of OIDC discovery fields including token_endpoint and jwks_uri. The vulnerability is rated HIGH with CVSS 8.6.
🔗 Read more 🔗
Source: NVD
👑 Dokploy Role Escalation Can Lead to Permanent Organization Takeover
Dokploy administrators should upgrade to 0.29.6 or later promptly, particularly on shared or multi-user installations. Review recently created accounts and owner-role assignments as part of remediation because successful exploitation can establish persistent control of an organization.
CVE-2026-45790 affects Dokploy before version 0.29.6. A user with member:create permission can invite an account with the owner role, while a privileged self-hosted user can create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. The vulnerability is rated HIGH with CVSS 8.0 and is fixed in version 0.29.6.
🔗 Read more 🔗
Source: NVD
💻 Pandora Stored XSS Executes Through Malicious URL Observables
Pandora operators should deploy the patch promptly, especially where analysts process untrusted files or URLs. Successful exploitation requires victim interaction but can act with the victim’s authenticated Pandora session, making analyst and administrative accounts valuable targets.
CVE-2026-75531 is a stored cross-site scripting vulnerability in Pandora’s rendering of URL observables. An attacker-controlled URL embedded in the inline JavaScript handler for the Submit to Lookyloo action can break out of its JavaScript string and execute arbitrary code when a victim interacts with the control. The vulnerability is rated HIGH with CVSS 7.0, and the patch removes the observable value from the inline handler while adding safer DOM handling.
🔗 Read more 🔗
Source: NVD