CVE Vulnerability Advisory Database

[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions

[Impact] Remote, unauthenticated attackers can inject arbitrary SQL queries, manipulate the database, and gain full administrator access to the Metabase instance

[Mitigation] Apply the official vendor security patches immediately, or restrict access to the vulnerable endpoint using a WAF or reverse proxy

[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.

[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.

[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.

[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server via the agent polling protocol, leading to full system compromise

[Mitigation] Immediately upgrade TeamCity server to version 2026.1.3, 2025.11.7, or later

[Affected Scope] WordPress versions 6.9.x before 6.9.5, and 7.0.x before 7.0.2

[Impact] Unauthenticated attackers can exploit a REST API batch endpoint route confusion vulnerability, chaining it with the WP_Query SQL Injection (CVE-2026-60137) to compromise the database and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade WordPress core to patched versions (6.9.5, 7.0.2, or later), or temporarily disable the REST API batch endpoint and apply WAF rules

[Affected Scope] WordPress core versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2)

[Impact] Successful exploitation allows remote attackers to execute arbitrary SQL commands and retrieve sensitive database information when a plugin or theme passes untrusted input to the 'author__not_in' parameter of WP_Query.

[Mitigation] Immediately upgrade WordPress core to the patched versions (6.8.6, 6.9.5, or 7.0.2) and apply WAF filtering rules.

[Affected Scope] IBM Langflow OSS versions 1.0.0 through 1.10.0 in default deployments

[Impact] Unauthenticated attackers can obtain superuser tokens and execute arbitrary Python code, leading to full system compromise

[Mitigation] Immediately upgrade to the latest patched version, disable auto-login, and restrict network access to the application

[Affected Scope] All versions of Adobe Commerce and Magento Open Source prior to APSB26-73.

[Impact] Remote Code Execution (RCE) via malicious file upload, leading to full server compromise and potential data exfiltration.

[Mitigation] Apply official Adobe security patches (APSB26-73) immediately and restrict execution permissions in upload directories.

[Affected Scope] Microsoft SharePoint Server on-premises deployments

[Impact] Unauthenticated remote attackers can bypass security features over the network to access sensitive data or escalate privileges

[Mitigation] Apply the official Microsoft security updates immediately and restrict external network exposure until patched

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthorized remote attackers can execute arbitrary code over the network and fully compromise the system

[Mitigation] Apply the official Microsoft security updates immediately and restrict external network exposure

[Affected Scope] Microsoft Office SharePoint Server environments

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms over the network to elevate privileges to administrative levels

[Mitigation] Immediately apply the official Microsoft security patches and restrict external network access to SharePoint management endpoints

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and fully compromise the host server

[Mitigation] Apply the official Microsoft security updates immediately, and restrict network access to SharePoint endpoints until patched

[Affected Scope] Joomla Balbooa Forms extension versions prior to 2.4.1

[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full Remote Code Execution (RCE) and complete compromise of the web server

[Mitigation] Immediately upgrade the Balbooa Forms extension to version 2.4.1 or higher, and disable script execution in upload directories

[Affected Scope] LiteLLM proxy server and AI Gateway environments running versions prior to 1.84.0

[Impact] Unauthenticated attackers can bypass API key validation using a fabricated Authorization header, gaining unauthorized access to internal MCP tools and LLM APIs.

[Mitigation] Immediately upgrade the LiteLLM package to version 1.84.0 or higher.

[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code in the context of the current user, with active exploitation confirmed in the wild

[Mitigation] Immediately apply the official Adobe security patches (APSB26-68) and restrict access to sensitive endpoints

[Affected Scope] Joomla Page Builder CK extension versions prior to 3.6.0

[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full remote code execution (RCE) and complete compromise of the web server

[Mitigation] Immediately upgrade the Page Builder CK extension to version 3.6.0 or higher

[Affected Scope] Langflow versions prior to 1.9.1

[Impact] An authenticated attacker can execute arbitrary AI workflows belonging to other users by exploiting an IDOR vulnerability, potentially exposing sensitive data.

[Mitigation] Immediately upgrade Langflow to version 1.9.1 or higher, and restrict network access until patched.

[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8

[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).

[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.

[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla

[Impact] Unauthenticated attackers can upload and execute malicious PHP code, leading to complete takeover of the web server

[Mitigation] Immediately update to the latest patched version, apply WAF rules, and disable PHP execution in upload directories

[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges by deserializing untrusted data.

[Mitigation] Apply the official vendor security patches (CPS) immediately, restrict external network exposure, and enable WAF deserialization detection rules.

[Affected Scope] LiteSpeed cPanel plugin versions prior to 2.4.8 (distributed in LiteSpeed WHM PlugIn prior to 5.3.2.0)

[Impact] An attacker with FTP or web shell access on a shared hosting server running CloudLinux/CageFS can exploit symlinks to bypass isolation, escalate privileges, and compromise the server

[Mitigation] Immediately upgrade the LiteSpeed WHM plugin to version 5.3.2.0 or higher to apply the patched cPanel plugin (v2.4.8+)