CVE-2026-79823

HPE NonStop EMS Distributor - Buffer Overflow vulnerability

HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ems Distributor

CVE-2026-47786

Pre-Authentication Command Injection

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Qnap Systems

Products

Hybriddesk Station

CVE-2026-79827

HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Inspect Subsystem

CVE-2026-79828

HPE NonStop Debug Utilities - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Debug Utilities

CVE-2026-79829

HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Http Webserver

CVE-2026-110726

Default Rate‑Limit Key Resolver Allows Unlimited Bypass via X‑Forwarded‑For Manipulation

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Connected Services Platform

CVE-2026-110724

Rate Limiting Bypass via Untrusted X‑Forwarded‑For Header in Eclipse Connected Services Platform API Gateway

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Connected Services Platform

CVE-2026-110723

API Gateway Bypass of Rate Limiting via Untrusted X-Forwarded-For Header

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Connected Services Platform

CVE-2026-105065

WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress-extensions

Products

Xstore Xstore

CVE-2026-103936

libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Libp2p

Products

Libp2p Webrtc

CVE-2026-103083

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elextensions Wordpress-extensions

Products

Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes

CVE-2026-96449

WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpexperts

Products

Wp Easypay Wp Easypay

CVE-2026-109689

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sunshinephotocart Wordpress-extensions

Products

Sunshine Photo Cart Sunshine Photo Cart

CVE-2026-111125

CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Heasarc Nasa

Products

Cfitsio Cfitsio

CVE-2026-111365

cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Cool-team-official

Products

Cool-admin-midway

CVE-2026-111366

cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cool-team-official

Products

Cool-admin-midway

CVE-2026-100108

Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting

The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Maxfoundry Wordpress-extensions

Products

Social Share Buttons Social Share Buttons

CVE-2026-96870

SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Brainstorm Force Brainstormforce Wordpress-extensions

Products

Suredash Suredash Suredash

CVE-2026-92766

Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Appsbd Wordpress-extensions

Products

Vitepos Vitepos

CVE-2026-96768

GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Softaculous Wordpress-extensions

Products

Gosmtp Pro Gosmtp Pro