Archive
25 September 2026
Vulnerabilities first published on this day (UTC), newest first.
20 results · Clear filters · Feed
-
Critical 10.0CVE-2026-100382 Public exploit
Unauthenticated remote code execution through wikitext in ExternalData
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * befo…
-
Medium 5.3CVE-2026-100381 Public exploit
UploadWizard Flickr collection and set titles allow DOM XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from…
-
Medium 5.3CVE-2026-100380 Public exploit
Reflected XSS in Wikibase Special:SetLabel language validation
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * befor…
-
Medium 6.9CVE-2026-96878 Public exploit
Cargo Exhibit field alias allows stored XSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
-
Medium 6.9CVE-2026-96877 Public exploit
Reflected XSS through Cargo Drilldown full-text search
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
-
Medium 6.9CVE-2026-96876 Public exploit
Anonymous reflected XSS in CargoExport invalid-alias errors
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
-
Medium 6.9CVE-2026-96875 Public exploit
Reflected XSS in Cargo Drilldown hierarchy filters
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
-
High 7.1
GLPI: SQL injection in history tab
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection…
-
High 7.5CVE-2026-53625 Public exploit
GLPI: Privilege Escalation via authtype API manipulation
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interfac…
-
Critical 9.1CVE-2026-42322 Public exploit
Piwigo: Authenticated RCE via File Upload in Logo Upload Feature
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the sto…
-
Low 2.3CVE-2026-96874 Public exploit
Stored XSS in Cargo Drilldown tab names
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
-
High 8.8CVE-2026-93834 Public exploit
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data…
-
High 7.8CVE-2026-97941 Public exploit
mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312607 ("mm, slab: add an optimistic __slab_try_return_freelist()") incorrectly assumed that nobody has f…
-
High 8.8CVE-2026-97555 Public exploit
smb: client: fix heap overflow in DACL owner/group rewrite
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dac…
-
Medium 6.1CVE-2026-88996 Public exploit
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and inc…
-
Critical 9.8CVE-2026-14281 Public exploit
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly ac…
-
Critical 9.1CVE-2026-93399 Public exploit
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to …
-
Critical 9.1CVE-2026-89055 Public exploit
Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possi…
-
High 8.8CVE-2026-62062 Public exploit
WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.
-
Medium 6.5CVE-2026-51772 Public exploit
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_mult…