IONIX THREAT CENTER

CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can be exploited remotely, without authentication, to cause a denial of service. The flaw carries a CVSS score of 8.7 (High) and affects multiple 14.1 and 13.1 release branches, including FIPS builds. Citrix has published fixed builds for all affected branches under advisory CTX697174.

CVE-2026-91078 is an Improper Authentication (CWE-287) vulnerability in the TillKit WordPress plugin, affecting all versions prior to 1.0.5. The plugin provisions a privileged Point-of-Sale (POS) "manager" account at activation time with a hard-coded, publicly known default PIN that site owners are never required to change. Because the public-facing POS login endpoint validates access solely on this static PIN with no identity or capability checks, any unauthenticated remote attacker can log in as the privileged POS account.

CVE-2026-89236 is an unauthenticated SQL injection vulnerability in the SaveTo Wishlist Lite WordPress plugin, caused by insufficient sanitization and escaping of parameters used in the ORDER BY clause of a SQL query. The flaw affects all plugin versions prior to 1.1.5 and carries a CVSS v3.1 base score of 8.6 (High), allowing remote, unauthenticated attackers to extract sensitive information from the site's database.

CVE-2026-103065 is a broken access control vulnerability in the Kirki WordPress plugin (developed by Themeum), caused by improper validation of specified input quantities that allows unauthenticated attackers to reach functionality that should be restricted by access control lists (ACLs). The issue affects Kirki versions through 6.3.1 and carries a CVSS v3.1 base score of 8.2 (High). It was fixed in version 6.3.2.

CVE-2026-105115 is a missing authentication vulnerability in OpenAM's legacy JAX-RPC SOAP interface (/jaxrpc/*) that allows an unauthenticated, network-based attacker to load and instantiate arbitrary Java classes available on the server's classpath. The flaw affects all OpenAM versions through 16.1.2 and carries a High/Critical severity rating given its unauthenticated, network-exploitable nature and potential for server crashes, classpath enumeration, or code execution.

CVE-2026-104476 is an information disclosure vulnerability in Backdrop CMS affecting versions before 1.35.1 (and 1.34.x before 1.34.5). When a user with permission to synchronize, import, and export configuration performs a configuration export, Backdrop CMS leaves the resulting compressed configuration archive accessible on the server after it has been transferred to the user. An unauthenticated remote attacker who locates this archive can download it and obtain sensitive site configuration data.

CVE-2020-37278 is a high-severity, unauthenticated arbitrary file read vulnerability in Weaver e-Bridge, a collaborative office/portal platform widely deployed by Chinese enterprises. The flaw resides in the saveYZJFile endpoint, which accepts attacker-controlled file: and http(s): URLs in its downloadUrl parameter, allowing remote, unauthenticated attackers to read arbitrary files from the host or force the server to make requests to internal network resources (SSRF).

CVE-2014-125130 is a path traversal vulnerability (CWE-22) in the CodeArt Google MP3 Audio Player WordPress plugin, developed by Damjan, affecting versions 1.0.11 and earlier. The flaw allows unauthenticated remote attackers to read arbitrary files from the server's filesystem via the plugin's direct_download.php script, including wp-config.php, which exposes WordPress database credentials. The vulnerability has been observed being exploited in the wild, with exploitation activity first reported by the Shadowserver Foundation on October 19, 2023.

CVE-2026-94483 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the Image Optimization feature of Next.js. An attacker who controls DNS resolution for a remote hostname that matches an application's configured images.remotePatterns allow-list can cause the image-optimization fetch to resolve to a private IP address, allowing the server to reach internal network resources on the attacker's behalf. The issue carries a CVSS v4.0 base score of 8.3 (High) and affects self-hosted Next.js deployments that configure images.remotePatterns.

CVE-2026-104458 is a Server-Side Request Forgery (SSRF) vulnerability in YesWiki, an open-source wiki engine, affecting versions before 4.6.7. The flaw lies in the validateKeyIdUrl() function used to validate ActivityPub Signature.keyId URLs, which fails to canonicalize certain IPv6 transition address formats before applying its private-range filters. This allows an unauthenticated attacker to bypass the existing SSRF guard and reach internal hosts, loopback services, or cloud metadata endpoints, resulting in a High severity rating.

CVE-2026-104464 is a Server-Side Request Forgery (SSRF) vulnerability in YesWiki, a PHP-based collaborative wiki platform. The flaw resides in the Bazar extension's "abonnements" sync action, which accepts an attacker-controlled actor URL and fetches it from the server without validation. The vulnerability is rated High severity (CVSS 8.8) and is exploitable by unauthenticated remote attackers.

CVE-2026-104410 is a missing-authorization vulnerability in SiYuan Note, a self-hosted note-taking and knowledge-base application, affecting its public "publish" sharing mode. The flaw lets a publish reader (including anonymous visitors when Basic Auth is disabled) retrieve the full contents of database rows that are marked password-protected or have publishing disabled, by calling the POST /api/export/preview endpoint. NVD/vendor scoring places this at CVSS v3.1 7.5 (High) / CVSS v4.0 8.7 (High), reflecting a network-exploitable, no-privilege-required confidentiality breach.

CVE-2026-104445 is an authentication bypass vulnerability (CWE-290) in YesWiki's ActivityPub inbox implementation, affecting all versions prior to 4.6.7. The flaw lets any unauthenticated attacker who controls an ActivityPub keypair delete or overwrite federated wiki entries belonging to other actors. The issue carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.8 (High), and requires no authentication or user interaction to exploit remotely.

CVE-2026-104438 is a missing authorization (CWE-862) vulnerability in YesWiki, an open-source PHP wiki engine, affecting versions before 4.6.7. The listpagestag and includepages actions in YesWiki's tags tool enumerate pages without applying read-ACL filtering, allowing unauthenticated or unprivileged attackers to disclose the names and body-derived titles of access-controlled pages. The flaw carries a CVSS v4.0 base score of 8.7 (High).

CVE-2026-104463 is an unauthenticated server-side request forgery (SSRF) vulnerability in YesWiki, a collaborative wiki/CMS platform. The flaw resides in YesWiki's ActivityPub implementation and allows an unauthenticated remote attacker to force the server to issue arbitrary outbound HTTP GET and POST requests. The issue affects all YesWiki versions prior to 4.6.7 and carries a high severity rating.

CVE-2026-104460 is an unauthenticated blind SQL injection vulnerability in YesWiki, an open-source wiki engine, affecting the {{newtextsearch}} search action. The flaw allows anonymous attackers to extract arbitrary data from the application database — including administrator password hashes — without any authentication or user interaction. The vulnerability carries a CVSS v4.0 base score of 8.7 (High).

CVE-2026-104462 is a SQL injection vulnerability in YesWiki, an open-source wiki engine, affecting versions before 4.6.7. The flaw resides in the Bazar nuagetag action, which concatenates an unescaped tags parameter directly into a raw SQL IN clause, allowing an attacker to inject arbitrary SQL and exfiltrate database contents including user password hashes. The issue carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.8 (High).

CVE-2026-104457 is a SQL injection vulnerability in YesWiki, an open-source wiki engine, affecting versions before 4.6.7. The flaw resides in the Bazar filtertags action, where unescaped filterN attribute tokens are concatenated directly into a raw SQL IN (…) clause, allowing unauthenticated attackers on default installations to read arbitrary database contents, including user password hashes. The issue carries a CVSS v3.1 base score of 8.6 (High) and a CVSS v4.0 score of 8.8 (High).