CVE-2026-85401

Dolibarr Legacy File Manager config.inc.php access control

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dolibarr

Products

Dolibarr

CVE-2026-85382

light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a manipulation of the argument content results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Light0011

Products

Cms

CVE-2026-85241

SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Specterops

Products

Bloodhound

CVE-2026-85208

itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Online Medicine Delivery System

CVE-2026-85149

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Lightstar

Products

Smartit Desktop Manager

CVE-2026-85148

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Lightstar

Products

Smartit Desktop Manager

CVE-2026-85147

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Lightstar

Products

Smartit Desktop Manager

CVE-2026-85146

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Lightstar

Products

Smartit Desktop Manager

CVE-2026-85085

Canva Android App External WebView Misconfiguration Enables Session Hijacking

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Canva

Products

Canva

CVE-2026-85061

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Maplibre

Products

Maplibre-gl-js

CVE-2026-82923

AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-82520

parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Domainaware

Products

Parsedmarc

CVE-2026-81859

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Cloud Pak For Business Automation

CVE-2026-32480

WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wclovers Wordpress

Products

Wcfm Membership Wordpress

CVE-2026-27432

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-27347

WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock Wordpress

Products

Jetpopup Wordpress

CVE-2026-18167

Stack-based buffer overflow in TP-Link Archer AX55 v4

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax55 V4

CVE-2026-18824

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aix Powervm Vios Vios

CVE-2026-63509

Microsoft Fabric Elevation of Privilege Vulnerability

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Fabric Microsoft Fabric

CVE-2026-69419

Azure Data Manager for Energy Remote Code Execution Vulnerability

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Data Manager For Energy