IONIX THREAT CENTER

CVE-2026-11575 is a high-severity payment authorization bypass vulnerability in the PhonePe Payment Solutions WordPress plugin, affecting all versions prior to 3.1.0. The flaw allows unauthenticated remote attackers to forge payment-success callbacks and mark unpaid WooCommerce orders as paid without any actual transaction taking place. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and was remediated in version 3.1.0, released June 25, 2026.

CVE-2026-62230 is a high-severity sensitive file disclosure vulnerability affecting Grav CMS versions prior to 2.0.4. The default .htaccess configuration shipped with Grav omits the Apache [NC] (No Case) flag from file-blocking rules, making extension matching case-sensitive. On case-insensitive filesystems, an unauthenticated remote attacker can bypass these protections by requesting sensitive files with uppercase or mixed-case extensions, potentially exposing credentials, API keys, and other secrets stored in Grav configuration files.

CVE-2026-33692 is a high-severity sensitive file exposure vulnerability affecting WWBN AVideo, an open-source video streaming platform, in all versions prior to 29.0. The official Docker Compose configuration mounts the entire project root directory as the Apache document root, causing the .env file — which contains database credentials, admin passwords, and internal network topology — to be served unauthenticated as a plain static file at /.env. The issue has been resolved in version 29.0.

CVE-2026-55173 is a high-severity OS command injection vulnerability affecting WWBN AVideo versions 29.0 and below, arising from an incomplete fix of CVE-2026-33482. The sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php fails to neutralize the bare & shell background operator, leaving the execAsync() sh -c execution sink exploitable. An unauthenticated remote attacker who can craft a valid encrypted payload can inject and execute arbitrary OS commands on the server, achieving full remote code execution (RCE).

CVE-2026-57831 is a high-severity unauthenticated SQL injection vulnerability in the DPCalendar extension for Joomla, developed by digital-peak.com. The flaw allows any unauthenticated remote attacker to read the entire site database by sending a single crafted HTTP request to the extension's publicly exposed events feed endpoint, with no privileges or user interaction required. The vulnerability carries a CVSS 4.0 score of 8.7 (High).

CVE-2026-15008 is a high-severity unauthenticated PHP Object Injection vulnerability affecting the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress in all versions up to and including 7.3.1.4. The flaw resides in the fr_token function and enables unauthenticated attackers to delete arbitrary files on the server, which can directly escalate to Remote Code Execution (RCE). The vulnerability carries a CVSS v3.1 base score of 8.1 (HIGH).

CVE-2026-58077 is an unauthenticated stored cross-site scripting (XSS) vulnerability in the 4Analytics extension for Joomla, developed by weeblr.com. The flaw resides in the extension's Markdown-to-HTML conversion within its AI traffic analysis feature, where attacker-supplied content can be persisted and subsequently rendered as active JavaScript when viewed by a legitimate user. With a CVSS 4.0 score of 8.7 (High), the vendor confirms that a specially crafted unauthenticated request may result in website takeover under certain circumstances.

CVE-2026-12512 is a high-severity, unauthenticated UNION-based SQL injection vulnerability affecting the Quotes llama WordPress plugin in all versions before 3.1.6. The flaw stems from insufficient sanitization of a user-supplied parameter (sc) processed by publicly accessible AJAX handlers, allowing any unauthenticated remote attacker to read arbitrary data from the underlying WordPress database. With a CVSS v3.1 score of 8.6 (High), successful exploitation can expose password hashes and other sensitive database contents, enabling potential account takeover and full site compromise.

CVE-2026-12753 is a high-severity unauthenticated SQL injection vulnerability affecting the Advance Product Search – Voice & Ajax Search for WooCommerce plugin by ThemeHunk, all versions up to and including 1.4.4. The flaw allows any remote, unauthenticated attacker to extract sensitive data directly from the WordPress/WooCommerce database. With over 10,000 active installations, the attack surface is significant and immediate patching is required.

CVE-2026-42533 is a heap buffer overflow vulnerability (CWE-122) in NGINX Plus and NGINX Open Source, rated High severity with a CVSS v3.1 base score of 8.1. The flaw is triggered by a specific interaction between the map directive and regex capture variables in NGINX configurations, allowing an unauthenticated remote attacker to send crafted HTTP requests that overflow the NGINX worker process heap. The result is a denial-of-service condition (worker restart); on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, full Remote Code Execution (RCE) is…

CVE-2026-12997 is a high-severity Directory Traversal vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 2.10.4. An unauthenticated remote attacker can supply a malicious file path via the gform_uploaded_files parameter at the process_send_resume_link endpoint to read arbitrary files from the server, with the retrieved file contents delivered as an email attachment to an attacker-controlled address. The vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) and requires no authentication or user interaction to exploit.

CVE-2026-46485 is a high-severity authorization bypass vulnerability affecting Dashy (lissy93/dashy), a self-hostable personal dashboard, in all versions prior to 4.0.8. The flaw allows unauthenticated users — or non-admin authenticated users — to write arbitrary changes to the application's main config.yaml via the /config-manager/save endpoint, completely circumventing OIDC-based access controls. The vulnerability carries a CVSS v3.1 score of 8.2 (HIGH).

CVE-2026-12382 is a high-severity authentication bypass vulnerability (CWE-290: Authentication Bypass by Spoofing) in Red Hat Ansible Automation Platform 2 (AAP), affecting the automation-gateway component's Envoy proxy configuration. A misconfiguration in the non-mTLS route to Event-Driven Ansible (EDA) event streams allows an unauthenticated remote attacker to spoof a trusted client identity and inject arbitrary events into protected EDA event streams. The vulnerability carries a CVSS v3.1 base score of 8.2 (High).

CVE-2026-62685 is a high-severity directory scope collision vulnerability in File Browser (filebrowser/filebrowser), a widely deployed self-hosted web file management interface. When both the Signup and CreateUserDir features are enabled, the cleanUsername() function maps distinct usernames to the same home directory path without checking for prior occupancy, allowing an unauthenticated attacker who self-registers a crafted username to gain full read and write access to an existing user's files. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and affects all versions of File Browser prior to v2.63.17.

CVE-2026-60005 is a high-severity uninitialized memory access vulnerability (CWE-908) in the ngx_http_slice_module of NGINX Plus and NGINX Open Source, assigned a CVSS v3.1 score of 8.2 (HIGH). The flaw allows unauthenticated remote attackers to trigger limited disclosure of NGINX worker process memory or cause a worker process restart (denial of service) by sending crafted HTTP requests — no credentials or user interaction required.

CVE-2026-61684 is a high-severity authentication bypass vulnerability (CVSS 4.0: 8.8) affecting FastGPT, an open-source, self-hosted knowledge-based AI application platform developed by labring. The flaw stems from a hard-coded default credential used to sign JWTs that guard the platform's plugin invoke endpoints — a misconfiguration present in virtually all default deployments — enabling unauthenticated remote attackers to perform cross-tenant user data disclosure and unauthorized file writes. The vulnerability is fixed in FastGPT version 4.15.0-beta5.

CVE-2026-12281 is a high-severity authentication bypass vulnerability in the Shibboleth WordPress plugin affecting all versions before 2.5.4. The flaw causes the plugin to fail open when its HTTP header identity mode is active without an anti-spoofing key configured, accepting any request that supplies identity headers as a fully authenticated session — without verifying those headers. Under specific but realistic configurations used in higher-education and federated-identity environments, an unauthenticated remote attacker can forge those headers, trigger automatic account creation, and be granted full WordPress administrator access.

CVE-2026-56400 is a critical CORS (Cross-Origin Resource Sharing) misconfiguration vulnerability in Open WebUI versions prior to 0.3.14, carrying a CVSS 4.0 score of 9.0. When allow_origins is set to the wildcard *, an attacker can craft malicious cross-site requests from an attacker-controlled website that, when visited by an authenticated admin, result in arbitrary code execution on the Open WebUI instance. Because Open WebUI commonly runs as root within Docker containers by default, successful exploitation yields full container compromise.

CVE-2026-48489 is a high-severity security firewall bypass vulnerability in the symfony/security-http component of the Symfony PHP framework. When a firewall is configured with failure_forward: true, an unauthenticated attacker can craft a failing login request to bypass access_control rules and receive the response from a protected route as if they were authenticated. The vulnerability carries a CVSS 4.0 base score of 8.7 (Critical).

CVE-2026-48310 is a high-severity Path Traversal vulnerability (CWE-22) in Adobe Experience Manager (AEM), affecting AEM as a Cloud Service releases up to 2026.5.0, AEM 6.5 LTS Service Pack 1 and earlier, and AEM 6.5 Service Pack 24 and earlier. An unauthenticated remote attacker can exploit this flaw to read arbitrary files outside the intended directory scope, with no user interaction required. The vulnerability carries a CVSS v3.1 base score of 8.6 (High).

CVE-2026-48252 is a Missing Authentication for Critical Function vulnerability (CWE-306) in Adobe Experience Manager (AEM) affecting AEM as a Cloud Service, AEM 6.5 LTS, and AEM 6.5. Rated High severity with a CVSS v3.1 base score of 8.6, the flaw allows unauthenticated remote attackers to bypass security controls and gain unauthorized write access to the system, with scope changed beyond the vulnerable component.

CVE-2026-45071 is an XML External Entity (XXE) injection vulnerability in the Symfony symfony/dom-crawler component, affecting all supported Symfony branches prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12. The flaw enables unauthenticated, network-accessible attackers to supply malicious XML that causes the server to read and disclose arbitrary local files. It carries a CVSS 4.0 score of 8.7 (High) with no authentication and no user interaction required.

CVE-2026-47767 is a high-severity patch-bypass vulnerability in the Symfony Runtime component (symfony/runtime) affecting Symfony versions 5.4.46 through 8.0.11. It bypasses the earlier fix for CVE-2024-50340 by exploiting an interpretation conflict between PHP's parse_str() function and the web SAPI's argv population mechanism, allowing unauthenticated, network-based attackers to manipulate the APP_ENV and APP_DEBUG application settings via a crafted HTTP query string. With a CVSS 4.0 score of 8.3 (High), exploitation requires no authentication and no user interaction, and is made significantly more widespread by the fact that the precondition (register_argc_argv=On) is enabled…