Свежие уязвимости · Страница 69

FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.

• Обновитесь до 5.3.2

JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.

Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.

WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.

• Обновитесь до 1.1.5

WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

• Обновитесь до 2.6.2

Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

• Обновитесь до 25.4.01 hotfix 22
• Обновитесь до 26.1.01 hotfix 12

WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.

• Обновитесь до 1.44.1

WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.

• Обновитесь до 2.4.28

WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.

• Обновитесь до 2.7.2

WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.

• Обновитесь до 1.7.0

Stored Cross-Site Scripting in BMC ITSM Attachments

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

• Обновитесь до 25.4.01 hotfix 22
• Обновитесь до 26.1.01 hotfix 12

Stored Cross-Site Scripting in BMC ITSM Work Notes

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

• Обновитесь до 25.4.01 hotfix 22
• Обновитесь до 26.1.01 hotfix 12

WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

• Обновитесь до 2.2.28

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.

• Обновитесь до 2.4.28

Server-Side Request Forgery in BMC ITSM SmartIT

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.

• Обновитесь до 25.4.01 hotfix 22
• Обновитесь до 26.1.01 hotfix 12

WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.

• Обновитесь до 8.3.6

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

• Обновитесь до 2.8.19

WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

• Обновитесь до 3.9.0.2

CVE-2026-112621

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing a maliciously crafted image may result in memory corruption.

• Обновитесь до 26.7.2
• Обновитесь до 27.2

WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.

• Обновитесь до 7.9.8