Threat briefs

An authentication flaw in FooSales POS for WooCommerce (<= 1.43.0) allows authenticated users with cashier permissions to perform account takeover by modifying arbitrary user email addresses.

An unauthenticated stored XSS vulnerability in the Easy Digital Downloads WordPress plugin allows attackers to inject malicious scripts via PayPal IPN parameters.

The GeoDirectory plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the design_type parameter, allowing remote attackers to execute arbitrary PHP code.

The LatePoint Appointment Booking plugin for WordPress allows authenticated users with specific capabilities to elevate customer account privileges to administrator via insecure settings management.

The LifterLMS WordPress plugin is vulnerable to authenticated PHP Object Injection, allowing attackers with edit_course capabilities to potentially execute code if a compatible POP chain exists elsewhere in the environment.

The PPOM - Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion and reading via improper path validation in the rename_files function, facilitating potential RCE.

CVE-2026-0023 allows a malicious installer to suppress security warnings by manipulating internal installation flags, potentially facilitating the installation of malicious updates for legitimate applications.

A vulnerability in i-doit Pro (versions 25 and below) allows attackers to perform brute-force attacks on the admin-center, enabling the upload of malicious plugins to achieve remote code execution.

The rtMedia for WordPress plugin contains a vulnerability in the 'process' function allowing unauthenticated attackers to delete arbitrary files on the server by leveraging exposed nonces.

An authenticated administrator can exploit CVE-2026-104021 in the Fastcache plugin for WordPress to inject arbitrary Apache directives into the .htaccess file, leading to remote code execution.

CVE-2026-104797 allows unauthenticated attackers to change the passwords of any WordPress user, including administrators, via an unverified profile update action in the Advanced Form Integration plugin.

An unauthenticated authorization bypass in the Avada Fusion Builder plugin for WordPress allows attackers to trigger arbitrary action hooks via crafted AJAX form submissions.

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to unauthenticated remote code execution via the xpv_image parameter in versions up to 2.16.2.

The Extensions For CF7 WordPress plugin is vulnerable to unauthenticated remote code execution via arbitrary file upload due to insufficient input validation in the extcf7_submit function.

The Blocksy Companion WordPress plugin is vulnerable to unauthenticated privilege escalation, allowing attackers to create arbitrary vendor accounts by bypassing Dokan registration security checks.

An authentication bypass vulnerability in the Advanced IP Blocker WordPress plugin enables unauthenticated attackers to brute-force MFA tokens and achieve complete site takeover via reusable nonces and lack of rate limiting.

Argo CD is affected by multiple vulnerabilities including CVE-2024-28113, CVE-2024-28114, CVE-2024-28115, and CVE-2024-28116, which allow for remote code execution, unauthorized information disclosure, and security control bypasses.

An insecure permission check in the pyload-ng API allows any authenticated user to perform administrative password brute-forcing via a side-channel oracle.

An improper implementation of the set_user_permission API endpoint in pyLoad allows users to retain elevated permissions for up to 31 days after an administrator has explicitly revoked their access.

A broken access control vulnerability in Vikunja allows read-only project members to retrieve sensitive link-share hashes and escalate their privileges to the permission level of those shares.

An unauthenticated remote denial-of-service vulnerability in yopass allows attackers to trigger monotonic memory growth by injecting arbitrary HTTP method strings into Prometheus metrics labels.

An unauthenticated remote denial-of-service vulnerability in ageLANServer allows attackers to trigger excessive memory consumption by sending crafted JSON arrays to the getFileURL endpoint.

Vikunja versions 2.2.0 through 2.6.0 contain a CORS misconfiguration that implicitly trusts all localhost ports, allowing local attackers to retrieve valid bearer tokens via credentialed cross-origin requests.

Vikunja versions up to 2.5.0 allow denial-of-service attacks by processing maliciously crafted high-aspect-ratio images in avatar and project-background upload endpoints that lack input validation.

The @tinacms/web-components package is vulnerable to stored Cross-Site Scripting (XSS) due to a failure to validate URL schemes in the tina-markdown component, allowing attackers to execute arbitrary code in the browser context of site visitors.

The TinaCMS CLI package fails to sanitize Git branch names during client code generation, allowing an attacker to inject and execute arbitrary JavaScript expressions within consumer build environments.

An unauthenticated stored XSS vulnerability in the Contao comments-bundle allows remote attackers to execute arbitrary JavaScript in the context of administrative sessions, potentially leading to full system compromise.

TinaCMS improperly validates admin preview URLs, allowing attackers to frame external origins and hijack the postMessage trust channel to perform unauthorized GraphQL operations.

Pingvin Share versions 0.19.0 through 1.21.x contain an authentication bypass vulnerability (CVE-2026-108157) allowing attackers to perform account takeover by exploiting improper email verification during OAuth registration.

LobsterAI versions 2026.5.27 through 2026.9.23 contain an arbitrary file deletion vulnerability in the skills:delete IPC handler, allowing attackers to delete arbitrary user-writable directories via malicious skill manifests.