IONIX THREAT CENTER

CVE-2026-14930 is a Missing Authorization (CWE-862) vulnerability in the JS Help Desk WordPress plugin (all versions before 3.1.4), rated High severity with a CVSS v3.1 score of 7.5. The plugin's front-end request dispatcher performs no authorization check, nonce validation, or ticket ownership verification, enabling fully unauthenticated remote attackers to upload files and attach them to any user's support ticket on an affected site. With over 7,000 active installations, the potential scope of exposure is meaningful for organizations relying on the plugin for customer support operations.

CVE-2026-28811 is an information-disclosure vulnerability in Apache JSPWiki in which debug messages reveal unnecessary information through error handling. All releases up to and including version 2.12.3 are affected. It carries a CVSS v3.1 base score of 7.5 (High), reflecting a network-exploitable, confidentiality-only impact.

CVE-2026-28814 is a high-severity information disclosure vulnerability in Apache JSPWiki affecting all versions up to and including 2.12.3. Due to missing authentication on critical wiki markup rendering functionality (CWE-306), unauthenticated remote attackers can render arbitrary wiki markup and obtain sensitive data stored in JSPWiki variables. The vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) and requires no credentials or user interaction to exploit.

CVE-2026-12251 is a high-severity improper privilege management vulnerability (CWE-269) in the Ultimate Member WordPress plugin, affecting all versions prior to 2.12.1. The flaw allows unauthenticated remote attackers to register on a vulnerable site using a custom role that carries administrator-level capabilities, resulting in full administrative takeover of the affected WordPress installation. With over 200,000 active installs, this vulnerability represents significant exposure across the WordPress ecosystem.

CVE-2026-56671 is an unauthenticated path traversal vulnerability in ComfyUI, the modular diffusion-model GUI, API, and backend from Comfy-Org. The flaw resides in the get_model_preview function and allows a remote attacker to read arbitrary image-decodable files and enumerate host paths without authentication. It affects all ComfyUI versions prior to 0.28.0 and is rated High (CVSS 7.5).

CVE-2026-56673 is an unauthenticated path traversal vulnerability in ComfyUI prior to version 0.28.0. The flaw lets a remote attacker craft a workflow that probes arbitrary host paths and exfiltrates image-format files, resulting in disclosure of sensitive files. It carries a CVSS v3.1 base score of 7.5 (High).

CVE-2026-63222 is a high-severity path traversal vulnerability in CodeIgniter4, a widely-used PHP full-stack web framework. The flaw resides in the UploadedFile::move() method, which — when invoked without a second argument — passes the client-supplied filename directly to the filesystem without sanitization, allowing a remote unauthenticated attacker to write uploaded content to arbitrary locations on the server. With a CVSS v3.1 base score of 7.5 (High), the vulnerability is exploitable over the network with no authentication or user interaction required, and can result in remote code execution (RCE) if a malicious…

CVE-2026-14541 is an authentication bypass and audience confusion vulnerability in the Google OAuth provider component of Google MCP Toolbox for Databases version 1.4.0. When the Google authService is configured with mcpEnabled: true but no explicit audience or clientId is defined, the token validation pipeline skips audience verification entirely, allowing any valid Google OAuth access token — regardless of its intended audience or application — to be accepted by the server. This vulnerability carries a CVSS 4.0 score of 8.0 (High) and is exploitable remotely with no privileges required.

CVE-2026-14540 is a Server-Side Request Forgery (SSRF) vulnerability in Google MCP Toolbox for Databases affecting versions 0.3.0 through 1.4.0. The flaw resides in the toolbox's generic HTTP source and tool components, where the internal HTTP client is initialized without redirect controls or target IP validation, allowing an unauthenticated remote attacker to coerce the server into issuing unauthorized HTTP requests to internal network resources or cloud metadata services. This vulnerability carries a CVSS 4.0 score of 8.0 (High) and requires no privileges or user interaction to exploit.

CVE-2026-14537 is an Incorrect Authorization vulnerability (CWE-863) in Google MCP Toolbox for Databases versions v1.3.0 and v1.4.0. An unauthenticated remote attacker can invoke tools protected by the scopeRequired authorization feature by routing tool invocation requests through legacy HTTP endpoints when the –enable-api flag is active, completely bypassing the intended access controls. With a CVSS 4.0 score of 8.1 (High) and high impact on confidentiality, integrity, and availability, this flaw poses a direct risk to any database system connected to an exposed toolbox instance.

CVE-2026-66421 is a stored cross-site scripting (XSS) vulnerability in OpenClaw Dashboard (openclaw-dashboard by tugcantopaloglu), a web-based monitoring and management interface for OpenClaw AI agents. An unauthenticated remote attacker can inject arbitrary HTML and JavaScript into agent transcript messages via the sessions API; the payload is stored server-side and executes automatically in the administrator's browser the next time the default dashboard landing page loads. The vulnerability carries a CVSS v3.1 score of 9.3 (Critical) and no vendor patch has been released as of the date of this advisory.

CVE-2026-68500 is an authorization bypass (payment status forgery) vulnerability in the Sylius Mollie Plugin. The plugin's payment webhook accepts attacker-controlled id and orderId parameters without verifying that the referenced Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker to mark arbitrary orders as paid. It carries a CVSS v3.1 base score of 7.5 (High).

CVE-2026-13395 is a high-severity unauthenticated SQL injection vulnerability in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions before 27.8. The flaw enables any anonymous, network-based attacker to inject malicious SQL via the public-facing booking form and extract sensitive data — including WordPress user password hashes — directly from the underlying database. With over 60,000 active installations, internet-exposed sites running the unpatched plugin represent a significant attack surface.

CVE-2026-13178 is an authorization bypass (CWE-639, Authorization Bypass Through User-Controlled Key) in the Eventin (WP Event Solution) WordPress plugin. The plugin does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated attackers to create orders marked as completed without paying. It affects all versions before 4.1.16 and is rated High severity (CVSS 7.5).

CVE-2026-12942 is a path traversal vulnerability (CWE-22) in IBM Langflow OSS versions 1.0.0 through 1.10.1, rated High severity (CVSS 7.5). An unauthenticated remote attacker can send specially crafted URL requests containing dot-dot sequences (/../) to unauthenticated API endpoints, enabling arbitrary file reads on the underlying server. IBM has released a patched version (1.10.2) and recommends immediate upgrade.

CVE-2026-22620 is an authentication bypass vulnerability, rooted in SQL injection (CWE-89), in Eaton's Tripp Lite series PowerAlert Device Manager (PADM) firmware. Improper input validation in the authentication component lets an unauthenticated remote attacker bypass authentication and obtain privileged user access to the device. It is rated HIGH severity (CVSS 8.6).

CVE-2026-14300 is a high-severity authentication bypass vulnerability (CWE-287) in the miniOrange Social Login and Register WordPress plugin (Discord, Google, Twitter, LinkedIn) affecting all versions before 7.8.0. An unauthenticated attacker can hijack any account on an affected site — including administrator accounts — by obtaining a one-time verification code for an email address they control and replaying it against a victim's email address, because the plugin fails to bind the code to the account for which it was issued. The CVSS v3.1 base score is 8.1 (HIGH).

CVE-2026-12687 is a high-severity improper privilege management vulnerability (CWE-269) in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin, developed by Metagauss, affecting all versions before 5.9.9.8. The flaw allows unauthenticated remote attackers to register directly into any group — including groups configured with the WordPress Administrator role — through the plugin's front-end registration form, bypassing all group access restrictions. On sites where an Administrator-level group exists, this results in full unauthenticated privilege escalation to WordPress Administrator.

CVE-2026-17543 is a high-severity SQL injection vulnerability in PHP's ext-pgsql extension, affecting PHP versions 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9. The flaw resides in the PHP language runtime itself — not in application-level code — meaning applications that rely on PHP's built-in PostgreSQL escape functions as their primary SQL injection defense are silently exposed. With a CVSS 4.0 score of 8.1, this vulnerability is exploitable remotely without authentication, and the official advisory characterizes exploitation as trivial.

CVE-2026-17544 is a high-severity out-of-bounds write vulnerability (CWE-787 / CWE-121) in the BCMath extension of PHP, affecting versions 8.4.x before 8.4.24 and 8.5.x before 8.5.9. The flaw is reachable via the bccomp() function when supplied with attacker-controlled operands and a scale parameter, and can result in stack or heap memory corruption with potential for Remote Code Execution. It carries a CVSS v4.0 base score of 8.1 (HIGH) with no privileges or user interaction required.