CVE-2026-116751

Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys

The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag[] (array KEYS)' parameter in all versions up to, and including, 9.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress's wp_magic_quotes escapes array values but not array keys, meaning attacker-controlled tag[] array keys reach EventRepository::getFilteredIds() completely unescaped and can be crafted to defeat the plugin's Statement::execute placeholder binder via overlapping strtr() substitution keys.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109899

WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107616

Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124492

SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Jihong88

Products

Suneditor

CVE-2026-73570

Zimbra Collaboration Remote Command Execution via SNMP Notification

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

CVSS 3.1 · 8.9 High EPSS 76.6% KEV · Listed

Vendors

Synacor Zimbra

Products

Zimbra Collaboration Suite Collaboration

CVE-2026-124437

Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-124438

Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-53985

Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Efstratios Goudelis

Products

Ground Station

CVE-2026-49948

Mem0 0.2.8 Missing Authorization via POST /configure Endpoint

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mem0ai

Products

Mem0

CVE-2026-29001

TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Tastyigniter

Products

Tastyigniter

CVE-2026-116818

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-109429

Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mistral

Products

Mistral-vibe

CVE-2026-109428

Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mistral

Products

Mistral-vibe

CVE-2010-20125

DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Dedecms

Products

Dedecms

CVE-2026-124331

Jinher OA ProjectAfficheManage.aspx sql injection

A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jinher

Products

Oa

CVE-2026-124489

OpenEMR before 8.3.0 Broken Access Control via portal_payment.php

OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters to view payment pages and record fraudulent payment receipts for arbitrary patients, corrupting billing records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124488

OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124484

OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs

OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124480

OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124477

OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr