Boletim Diário de Segurança

CVE-2026-102096

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system...

CVE-2026-102094

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load...

CVE-2026-102093

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator...

CVE-2026-102089

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVE-2026-97256

Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

CVE-2026-102392

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.

CVE-2026-103442

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

CVE-2026-103441

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

CVE-2026-97245

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

CVE-2026-96833

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

CVE-2026-96832

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

CVE-2026-96815

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

CVE-2026-96344

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

CVE-2026-96343

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

CVE-2026-94677

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

CVE-2026-94122

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

CVE-2026-93771

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

CVE-2026-93651

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

CVE-2026-93624

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

CVE-2026-97347

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2026-102454

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

CVE-2026-96649

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-102109

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an...

CVE-2026-97290

Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.

CVE-2026-94171

Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16 versions.

CVE-2026-102391

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.

CVE-2026-102376

Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

CVE-2026-100510

Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.

CVE-2026-47602

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver to dereference an untrusted pointer. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

CVE-2026-47554

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signature verification to be bypassed under memory pressure. A successful exploit of this vulnerability might lead to denial of service and data tampering.