CVE Vulnerability Catalog

CVE-2026-109213 has been rejected and must not be used. It is a reservation duplicate of CVE-2026-113499, which should be referenced instead. All descriptions and references for this candidate have been removed to prevent accidental usage.

The YITH WooCommerce Product Add-Ons plugin in versions up to 4.34.0 contains an unauthenticated bypass vulnerability. The description does not specify the mechanism, but indicates a bypass flaw exploitable without authentication.

The Ad Inserter plugin in versions up to 2.8.19 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.

The Arraytics Booktics plugin in versions up to 1.0.31 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects all versions from the start through 1.0.31.

The Meow Gallery plugin for WordPress is vulnerable to stored cross-site scripting via Attachment Alt Text (aria-label attribute) in all versions up to and including 5.5.1 due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.

The Forminator Forms plugin for WordPress in versions up to and including 1.57.3.1 is vulnerable to Insecure Direct Object Reference via the 'previous_draft_id' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress in versions up to and including 1.17.10 is vulnerable to stored cross-site scripting via inbound email body due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

A vulnerability in the GNU C Library (glibc) version 2.0 and later affects the gettext family of functions, which accept LANGUAGE environment variable entries containing '/' or equal to '..'. This allows an attacker to load a crafted message catalog (.mo file) from an arbitrary filesystem location, potentially crashing the program or executing arbitrary code with the program's privileges. The flaw is not covered by the earlier CVE-2014-0475 fix, which addressed other environment variables.

The NextGEN Gallery plugin for WordPress in versions up to and including 4.4.1 is vulnerable to remote code execution via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, where the extension check accepts sanitized .php_ filenames.

Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 5.5.4 because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with author-level access or above can enumerate and read metadata of all private and draft posts, including post ID, title, date, author, and status.

LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.

A flaw exists in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow.

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

A vulnerability was found in cak-filemanagement-system in the move_uploaded_file function of admin/add_logs.php. Manipulating the File argument allows unrestricted file upload, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.