IONIX THREAT CENTER

CVE-2026-62386 is a high-severity vulnerability (CVSS 8.2) classified as CWE-598 (Use of GET Request Method With Sensitive Query Strings), affecting the Grav CMS API plugin (getgrav/grav-plugin-api) in all versions before 1.0.0-rc.16. The plugin's JwtAuthenticator::extractBearerToken() method accepts JWT admin access tokens via the ?token= URL query parameter across every API route, causing valid tokens to be persistently logged and leaked through multiple channels. An attacker who obtains a leaked token gains full unauthorized administrative API access to the affected Grav installation.

CVE-2026-63088 is a Server-Side Request Forgery (SSRF) vulnerability in StoatChat's revolt-january backend component, affecting all versions prior to 0.14.0. The flaw allows unauthenticated, network-accessible attackers to bypass the platform's DNS-based IP blocklist and issue HTTP requests to internal-only hosts, including loopback and RFC1918 addresses. The vulnerability carries a CVSS v3.1 score of 8.6 (High).

CVE-2026-12691 is a high-severity Missing Authentication for Critical Function vulnerability (CWE-306) in Vimesoft Inc. Enterprise Video Platform, affecting all versions from 3.11.0.0 up to (but not including) 3.25.0. The flaw allows unauthenticated remote attackers to bypass authentication and access critical platform functions, resulting in full confidentiality compromise.

CVE-2026-53591 is a high-severity improper authentication vulnerability (CWE-287) in FreeScout, the open-source PHP/Laravel help desk and shared inbox platform, affecting all versions prior to 1.8.223. An unauthenticated remote attacker can inject arbitrary messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted In-Reply-To header, requiring no credentials or prior access. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).

CVE-2026-48812 is a high-severity unauthenticated information disclosure vulnerability affecting FreeScout, the self-hosted open-source PHP/Laravel help desk and shared inbox application, in all versions prior to 1.8.221. The vulnerability allows any remote, unauthenticated attacker to download attachments that were created by older versions of FreeScout without possessing a valid session or token, due to a missing authentication check in the attachment download route for legacy token types. It carries a CVSS v3.1 base score of 7.5 (High).

CVE-2026-11349 is a high-severity unauthenticated SQL injection vulnerability affecting the Modern Events Calendar Pro and Modern Events Calendar Lite WordPress plugins in all versions prior to 7.34.0. The flaw allows any unauthenticated remote attacker to inject arbitrary SQL and extract sensitive data from the WordPress database, with no credentials or user interaction required. This vulnerability carries a CVSS v3.1 base score of 8.6 (HIGH) with scope change, reflecting the potential for database-wide data exfiltration.

CVE-2026-63429 is a high-severity unauthenticated arbitrary file upload vulnerability in HeyForm, an open-source self-hosted form builder. Prior to version 3.0.0-rc.9, the POST /api/upload endpoint accepts file uploads from any anonymous internet user with no authentication or session validation, allowing attackers to store arbitrary files on an exposed HeyForm instance and obtain permanent public URLs hosted under the victim's domain. The vulnerability carries a CVSS v3.1 score of 8.6 (HIGH).

CVE-2026-46410 is a high-severity unauthenticated information disclosure vulnerability in FileBrowser Quantum, a free, self-hosted, web-based file manager maintained by gtsteffaniak. The flaw allows unauthenticated remote attackers to retrieve sensitive data — specifically file source and path information — through the application's share functionality, without any credentials or user interaction. It carries a CVSS 4.0 score of 8.7 (HIGH) and affects all versions prior to 1.3.2-stable and 1.4.1-beta.

CVE-2026-63030 ("wp2shell") is a pre-authentication Remote Code Execution vulnerability in WordPress Core, affecting versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2). It chains a route confusion flaw in the REST API batch endpoint with a SQL injection in WP_Query (CVE-2026-60137), enabling an unauthenticated attacker to execute arbitrary code on a default WordPress installation — no plugins, no special configuration, and no credentials required. Security patches were released on July 17, 2026, and WordPress.org has enabled forced automatic updates for affected installations.

CVE-2026-63094 is a high-severity open redirect vulnerability (CWE-601) in SigNoz, an open-source, OpenTelemetry-native observability platform, affecting all versions through 0.133.0. The flaw resides in the SSO authentication flow and allows unauthenticated remote attackers to steal victims' access and refresh tokens by delivering a crafted login URL, enabling full account takeover on any instance configured with Google OAuth, SAML, or OIDC. The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH).

CVE-2026-63101 is a high-severity missing authentication vulnerability (CWE-306) affecting Open Event Server (fossasia/open-event-server) through version 1.19.1. The flaw allows unauthenticated remote attackers to export the complete member roster — including email addresses, names, join dates, and roles — for any group hosted on the platform, with no credentials required at any step. The vulnerability carries a CVSS v4.0 score of 8.7 (HIGH) and a CVSS v3.1 score of 7.5 (HIGH).

CVE-2026-9585 is an unauthenticated reflected cross-site scripting (XSS) vulnerability in Sangoma Switchvox SMB Edition, affecting versions 8.3 (build 104997) through 8.4.0.1. The flaw resides in the invalid_browser and invalid_browser_login handlers — pre-authentication browser-compatibility screens reachable without any credentials — where the portal parameter is reflected unsanitized into server-generated JavaScript, enabling attacker-controlled script execution in a victim's browser. The vulnerability carries a CVSS 4.0 score of 8.6 (High) and was patched in version 8.4.0.2, released July 14, 2026.

CVE-2026-50528 is a Security Feature Bypass vulnerability (CWE-863: Incorrect Authorization) in the SslStream TLS/SSL implementation of Microsoft .NET, affecting .NET 8, .NET 9, and .NET 10. An unauthenticated remote attacker can exploit this flaw to bypass authorization checks performed during encrypted TLS communications, resulting in a high integrity impact. With a CVSS v3.1 base score of 8.2 (High), this vulnerability was patched by Microsoft on July 14, 2026 as part of the July 2026 Patch Tuesday release.

CVE-2026-13448 is a high-severity unauthenticated remote code execution (RCE) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.1. The flaw exists in the public flow build endpoint and allows a network-based attacker with no credentials to execute arbitrary code on the server. IBM has assigned a CVSS v3.1 base score of 8.1 (High) and recommends immediate upgrade to version 1.10.2.

CVE-2026-7872 is a path traversal vulnerability (CWE-22) in IBM Langflow OSS versions 1.0.0 through 1.10.0, rated High (CVSS 7.5). By uploading a specially crafted tar archive, an attacker can read arbitrary files from the server — including the application's JWT signing key — enabling complete authentication bypass through forged tokens for any user, including administrators. IBM has released version 1.10.1 to remediate the flaw.

CVE-2026-7488 is a high-severity sensitive information disclosure vulnerability affecting IKAS Technology Inc.'s E-Commerce SaaS platform, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data). With a CVSS v3.1 base score of 7.5 (HIGH), the flaw allows unauthenticated, remote attackers to retrieve embedded sensitive data from internet-exposed storefronts — requiring no privileges and no user interaction. The vulnerability was disclosed on July 17, 2026 via TR-CERT (Turkey's National Computer Emergency Response Center) under advisory TR-26-0572, and was discovered by security researcher Muhammed Taha YILMAZ.

CVE-2026-7189 is a high-severity vulnerability (CVSS 8.2) affecting Proliz Software Ltd. Co.'s OBS — a web-based Student Affairs Information System (Öğrenci Bilgi Sistemi) deployed across Turkish universities. The flaw involves the insertion of sensitive information into transmitted data (CWE-201), enabling unauthenticated remote attackers to access functionality not properly constrained by access control lists (ACLs).

CVE-2026-11961 is a high-severity unauthenticated privilege escalation vulnerability in the User Registration & Membership WordPress plugin (by wpeverest), affecting all versions prior to 5.2.3. The flaw stems from missing server-side validation of the membership tier supplied at registration time, allowing any unauthenticated user to claim an arbitrary published membership role — including administrator — without restriction. With a CVSS v3.1 score of 8.1 (High), successful exploitation on a susceptible site can result in full WordPress site compromise.