Trending Vulnerabilities

CVE-2026-107181 is an IPC record-delimiter injection vulnerability in Telegram Desktop versions before 7.2.9. Core::Sandbox fails to escape semicolons in externally supplied tg:// links before forwarding them through the single-instance IPC protocol. Crafted links can therefore introduce additional OPEN: records and invoke the legacy interpret: URI handler. Its InterpretSendPath function lacks adequate authorization and user confirmation, allowing attacker-supplied instruction files to upload files accessible to the Telegram process to an attacker-controlled channel. Exposure of local session data can enable account takeover when no local passcode protects that data. The public proof of concept demonstrated the exploit chain on Windows; exploitation on macOS and Linux was not demonstrated.

CVE-2026-105133 is an improper authentication vulnerability in the checkSysPwd function of the AhsayCBS API component. Manipulation of the random argument bypasses authentication controls and permits unauthorized access to protected API functionality. AhsayCBS versions through 10.3.2 are affected, and public exploit code is available. The vulnerability has been exploited in conjunction with CVE-2026-105134 to obtain operating system command execution. Version 10.3.4 is identified as fixed in advisories, but conflicting exploitation reports indicate that it remains vulnerable.

CVE-2026-107406 is a memory overflow vulnerability in the SAML processing of Citrix NetScaler ADC and NetScaler Gateway. An unauthenticated remote attacker could exploit an affected appliance to execute arbitrary code or cause denial of service. Exposure depends on the installed software build and whether the appliance operates as a SAML service provider (SP) or identity provider (IdP). Specified newer affected builds are vulnerable only in IdP configurations, while earlier builds are vulnerable in either role. Customer-managed appliances and Secure Private Access Hybrid deployments using affected NetScaler instances are in scope. The precise vulnerable function and buffer have not been publicly identified.

CVE-2026-93945 is an untrusted-data deserialization vulnerability in the Axiomthemes Balance WordPress theme affecting versions through 1.12.0, with an unspecified lower version bound. Deserialization of attacker-controlled data permits PHP object injection. The vulnerable function and input entry point are not identified.

CVE-2026-104398 is an untrusted-data deserialization vulnerability in the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin, affecting versions through 1.0.10. The vulnerability allows object injection. The earliest affected version and the vulnerable function are unspecified.

CVE-2026-108261 affects the administration preview functionality in tinacms before 3.14.0 and @tinacms/app before 2.5.14. Unsafe construction of the preview iframe URL from a hash-router splat allows attacker-controlled input to resolve to an external origin. The getExpectedPreviewOrigin function derives the trusted postMessage origin from that same URL, causing the GraphQL message channel to trust the attacker-controlled frame. An unauthenticated attacker can persuade a signed-in editor to open a crafted link and submit GraphQL queries or mutations through the editor's authenticated client, exposing or modifying protected content. The preview route is enabled by default in built administration bundles and development mode.

CVE-2026-105134 is an operating system command injection vulnerability in the AhsayCBS Replication Receiver component. The UpdateReceivers API inadequately sanitizes the random parameter before incorporating it into a system-level command, allowing remote attackers to execute arbitrary commands with the AhsayCBS service account's privileges. Affected versions include releases through 10.3.2; whether version 10.3.4 fixes the vulnerability is disputed. Public exploit code exists, and active attacks have chained this vulnerability with the authentication bypass CVE-2026-105133.

CVE-2026-105889 is a blind SQL injection vulnerability in the Tickera event-ticketing plugin, affecting versions through 3.6.0.6. Improper neutralization of special elements in SQL commands allows blind SQL injection. The earliest affected version and vulnerable function are unspecified.

CVE-2026-108474 is a SQL injection vulnerability in JetBrains Exposed versions before 1.5.1. Several SQL functions accept string arguments without proper escaping, allowing attacker-controlled input to alter generated SQL queries. The specific affected functions are not identified. Exploitation may enable unauthorized access to or modification of database data, depending on application usage and database permissions.

CVE-2026-82077 is a path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF. FaxProviderManagerImpl.sendFaxJob appends an attacker-controlled providerConnector value to the fax connector directory without validating the resulting path. An authenticated administrator can use relative path traversal to select another executable, control its arguments through fax provider settings, and trigger execution through ProcessUtils.execAndGetOutput. The vulnerability was demonstrated against PaperCut NG 26.0.4-PO build 76508 and fixed in version 26.0.5.

CVE-2026-93944 is an untrusted-data deserialization vulnerability in the ThemeREX Group Camelia WordPress theme affecting versions through 1.2.15, with no starting version specified. Deserialization of attacker-controlled data allows PHP object injection. The vulnerable function and input entry point are not identified.

CVE-2026-107845 is a stored cross-site scripting vulnerability in Contao's comments bundle. The listComments() function renders comment email and website metadata without sufficient HTML attribute and URL encoding. An unauthenticated visitor can submit malicious metadata that executes automatically in the Contao backend origin under a backend user's session when that user opens the Comments module. Unpublished comments also expose moderators. Affected releases begin with 4.0.0; the applicable fixed releases are 5.3.50 and 5.7.12.

CVE-2026-103071 is a code injection vulnerability in VillaTheme Thank You Page Customizer for WooCommerce affecting versions through 1.2.3; the earliest affected version is unspecified. Improper control of code generation allows code injection. The vulnerable function, injection input, and execution context are not specified.

CVE-2026-102255 is a pre-authentication server-side request forgery vulnerability in the SonicWall SMA1000 Appliance WorkPlace interface. An unintended alternate access path allows the appliance to act as a forward proxy, potentially enabling remote unauthenticated attackers to issue appliance-originated requests, reach internal functionality, and perform unauthorized operations. Affected models are SMA 6210, SMA 7210, and SMA 8200v running platform-hotfix 12.4.3-03526 and earlier in the 12.4.3 branch, or 12.5.0-02952 and earlier in the 12.5.0 branch. Exploitation attempts targeting the internal CouchDB service have been observed, but successful compromise has not been confirmed. SonicWall SMA 100 Series appliances and firewall-based SSL-VPN functionality are unaffected.

CVE-2026-93927 is an untrusted-data deserialization vulnerability in the Axiomthemes Veto WordPress theme affecting versions through 1.6.0; the earliest affected version is unspecified. Deserialization of attacker-controlled data allows PHP object injection. The vulnerable function and specific input entry point are not identified.

CVE-2026-93929 is an untrusted-data deserialization vulnerability in the ThemeREX Group Travesia WordPress theme affecting versions through 1.1.16; the earliest affected version is unspecified. Deserialization of attacker-controlled data permits PHP object injection. The vulnerable function and input entry point are not identified.

CVE-2026-62045 is an untrusted-data deserialization vulnerability in the ThemeREX Group Booklovers WordPress theme that allows PHP object injection. It affects versions through 2.13.0; the earliest affected version is unspecified. The vulnerable function and specific input handling path are not identified.

CVE-2026-62046 is an untrusted-data deserialization vulnerability in the ThemeREX Group Gutentype WordPress theme affecting versions through 2.1.12; the earliest affected version is unspecified. Deserialization of attacker-controlled data permits PHP object injection. The vulnerable function and input entry point are not identified.

CVE-2026-94589 is an arbitrary file upload vulnerability in the WordPress Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin through version 3.4.5. The extcf7_submit function processes signature-field uploads whose validation_filter() lacks file extension, MIME type, and size validation. A sanitize_file_name() bypass can transform a submitted filename into one with an executable PHP extension. Combined with missing PHP-execution guards in the upload directory, these weaknesses allow unauthenticated attackers to upload potentially executable files and may enable remote code execution.

CVE-2026-97670 is an authorization-bypass vulnerability in the Avada (Fusion) Builder plugin for WordPress affecting all versions through 7.16.1. Attacker-controlled form values pass through notification field placeholders into the dynamic-data processing pipeline, allowing the action_hook token to dispatch arbitrary WordPress action hooks without proper authorization. The is_content_request_supplied() trust gate checks request args but overlooks formData parsed by the public form-submission endpoint. Unauthenticated attackers can invoke multiple hooks in one request, permanently delete trashed site content, and trigger denial of service. Additional privileged writes depend on installed third-party handlers. The same pipeline permits blind user and post metadata reads, although results are delivered only to the site owner and cannot be exfiltrated through the plugin's own email or response paths.

Enclave OS Virtual's TDX/GPU RA-TLS certificate issuer, in releases before tdx-v0.2.43 and tdx-gpu-v0.6.27, fails to bind attestation evidence to the active TLS session. The issuer includes the certificate public-key hash and client nonce in quote ReportData but omits a session-bound value. An attacker possessing an enclave TLS private key can relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated TLS connection as the attested enclave.

CVE-2026-108269 affects the Rust and Go RA-TLS challenge verifiers in Remote Attestation TLS Clients before version 0.5.0. The verifiers accept attestation quote ReportData bound to the certificate public key and client nonce without verifying that it is bound to the active TLS session before allowing application traffic. An attacker possessing an enclave TLS private key can relay a genuine quote onto a different connection, causing a client to accept an attacker-terminated TLS connection as the attested enclave.

CVE-2026-108264 is a server-side template injection vulnerability in Wizarr versions before 2026.9.1. Wizard-step Markdown submitted through the editor or imported bundles is evaluated in a non-sandboxed Jinja2 environment with application globals exposed. An authenticated user permitted to create steps, or an administrator importing an untrusted bundle, can introduce malicious template content that executes arbitrary Python when the stored step is rendered. Additional evaluation sinks exist in Jinja filters and wizard-widget processing. Exploitation can enable operating-system command execution, disclosure of application secrets, access to credentials and the database, and stored cross-site scripting.

CVE-2026-108263 affects Astron Agent versions before 1.1.2. The default workflow code-node execution path selects LocalExecutor when CODE_EXEC_TYPE has not been explicitly changed. LocalExecutor exposes complete Python builtins during dynamic code execution rather than enforcing the documented sandbox restrictions. An authenticated, low-privilege tenant can consequently execute Python code as root in the core-workflow container and leverage shared service and database credentials to bypass application-level tenant isolation.