CVE-2026-88710

Unauthenticated Command Injection with Root Privileges on ASUS Router Firmware

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Asus

Products

Router Firmware

CVE-2026-88707

Out-of-Bounds Write in ASUS Router Firmware Facilitates Memory Corruption

An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Asus

Products

Router Firmware

CVE-2026-9063

Privilege Escalation via Insecure Configuration in AXIS OS

A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Axis Communications Ab

Products

Axis Os

CVE-2026-14543

VAPIX Edge Storage API Privilege Escalation via Filesystem Isolation Bypass

The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Axis Communications Ab

Products

Axis Os

CVE-2026-13387

Unintended External Redirection in AXIS Camera Station Pro Sign‑Out Flow

A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Axis Communications Ab

Products

Axis Camera Station Pro

CVE-2026-63287

Authenticated Non‑Admin Users Can Tamper with Audit Log Creation in Axis Camera Station

It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Axis Communications Ab

Products

Axis Camera Station Axis Camera Station Pro

CVE-2026-128824

Quay: quay: reflected xss via image_id in v1 registry error responses

A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Mirror Registry Quay and 2 more

CVE-2026-88709

Local Root Exploit via Unsanitized USB Directory Name in ASUS Router Firmware

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Asus

Products

Router Firmware

CVE-2026-88708

Off‑by‑one Error in ASUS Router Firmware Enables Memory Overwrite and Crash

An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Asus

Products

Router Firmware

CVE-2026-110989

RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission

The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-114452

Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payment Method Manipulation via IDOR

The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123707

WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wpgraphql

CVE-2026-129443

itsourcecode Airline Reservation System manage_user.php sql injection

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Airline Reservation System

CVE-2026-116559

A2Reviews <= 1.2.3 - Unauthenticated Plugin Data Modification and Disclosure

The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110960

Auth Armor <= 1.0.3 - Unauthenticated Account Takeover

The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110987

RegistrationMagic < 6.1.0.4 - Reflected XSS via 'rm_tr' and 'rm_ur' Parameters

The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-114451

Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter

The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124671

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Burst Statistics

CVE-2026-124673

Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View

The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Burst Statistics

CVE-2026-127048

Lazy Blocks < 3.0.0 - Unauthenticated RCE

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—