IONIX THREAT CENTER

CVE-2026-11974 is an unauthenticated path traversal (CWE-22) vulnerability in the WP Media Folder Addon WordPress plugin through version 4.1.6. The plugin fails to validate a user-supplied parameter before using it in a file read operation within two AJAX actions reachable by unauthenticated users, enabling arbitrary file disclosure and server-side request forgery (SSRF) on sites where a cloud storage connection is configured. It is rated HIGH severity with a CVSS v3.1 base score of 8.6.

CVE-2026-58177 is a high-severity vulnerability affecting the Cripts scripting framework component within Apache Traffic Server (ATS), a widely deployed enterprise-grade HTTP reverse proxy and caching server maintained by the Apache Software Foundation. The flaw encompasses three distinct vulnerability classes — out-of-bounds writes, path traversal, and use-after-free errors — and is remotely exploitable without authentication or user interaction. All ATS installations running versions 10.0.0 through 10.1.3 with the Cripts framework in use are potentially at risk, and upgrading to version 10.1.4 is strongly recommended.

CVE-2026-58179 is a high-severity stack-based buffer overflow vulnerability (CWE-121) in the regex_remap plugin of Apache Traffic Server (ATS), caused by insufficient bounds checking on substitution input. The flaw also triggers integer overflows during the same processing path. With a CVSS v3.1 score of 8.1 (High) and full Confidentiality, Integrity, and Availability impact scores (C:H/I:H/A:H), the vulnerability carries significant risk of complete system compromise on affected servers where the plugin is active.

CVE-2026-58163 is a high-severity vulnerability in Apache Traffic Server (ATS), an open-source reverse proxy and caching server widely deployed at the internet edge. The flaw stems from deserialization of untrusted data (CWE-502): ATS mishandles on-disk cache fields and object lifetimes, leading to cache state corruption or server crashes. It is exploitable remotely without authentication and carries a CVSS v3.1 score of 7.5 (HIGH).

CVE-2026-58188 is a high-severity vulnerability affecting Apache Traffic Server (ATS), a widely deployed enterprise-grade reverse proxy, caching, and load-balancing server. The flaw involves out-of-bounds write errors (CWE-787) and limit-bypass issues in several experimental ATS plugins, exposing affected deployments to denial-of-service conditions and potential security control circumvention. With a CVSS v3.1 score of 8.2 (HIGH), no authentication required, and no user interaction needed, internet-facing ATS deployments running experimental plugins should be patched immediately.

CVE-2026-58189 is a high-severity Server-Side Request Forgery (SSRF) amplification vulnerability (CWE-918) in Apache Traffic Server (ATS), a widely deployed internet-facing reverse proxy, forward proxy, and CDN caching platform. The flaw allows ATS plugins to reset the redirect retry counter, effectively bypassing the configured redirect limit and enabling unauthenticated network attackers to trigger unlimited outbound requests from the server. It carries a CVSS v3.1 score of 7.5 (High) and affects all supported major branches of Apache Traffic Server.

CVE-2026-58182 is a high-severity uncontrolled resource consumption vulnerability (CWE-400) in the ts_lua plugin of Apache Traffic Server (ATS), affecting versions 8.0.0 through 10.1.3. The flaw arises from the plugin's mishandling of initialization, transform context, and per-instance state, and is exploitable remotely without authentication or user interaction. It carries a CVSS v3.1 base score of 8.6 (HIGH), reflecting high availability impact alongside partial confidentiality and integrity risk.

CVE-2026-58159 is a high-severity incorrect authorization vulnerability (CWE-863) in Apache Traffic Server (ATS) that allows unauthenticated remote attackers to bypass IP-based access controls. The flaw exists in two distinct areas: IP access control enforcement on Unix Domain Socket (UDS) listeners, and errors in ACL matching logic. It carries a CVSS v3.1 base score of 8.2 (HIGH) and affects ATS versions 8.0.0 through 10.1.3 across all three supported branches.

CVE-2026-58157 is a high-severity information disclosure vulnerability in Apache Traffic Server (ATS), an open-source reverse proxy and caching solution deployed at the internet edge. The flaw stems from improper reuse of server sessions and tunnels, which can expose data from one client connection to another. With a CVSS v3.1 base score of 8.7 (HIGH) and a Scope:Changed rating reflecting cross-boundary impact, this vulnerability poses a significant risk to any organization running an affected ATS instance.

CVE-2026-67178 is an open redirect vulnerability (CWE-601) affecting MISP installations before version 2.5.41. MISP installation scripts generated an Apache HTTP-to-HTTPS redirect that lacked a trailing slash on the destination URL, allowing an unauthenticated remote attacker to craft URLs on the legitimate MISP domain that redirect victims to attacker-controlled sites. The issue is rated HIGH severity (CVSS v4.0 base score 7.8).

CVE-2026-14996 is an insufficient session expiration vulnerability (CWE-613) in IBM Aspera Faspex 5. Because sessions are not invalidated within an expected timeframe, an attacker who obtains a still-valid session artifact can gain unauthorized access to the application and its resources. IBM rates this issue HIGH with a CVSS v3.1 base score of 8.2.

CVE-2026-58186 is an improper input validation vulnerability (CWE-20) in the webp_transform plugin of Apache Traffic Server. The plugin decodes images unsafely and can serve mislabeled, cacheable responses when processing degraded input, resulting in an availability impact. The issue is rated HIGH severity (CVSS v3.1 base score 7.5) and is remotely exploitable over the network without authentication or user interaction.

CVE-2026-58159 is an incorrect-authorization (CWE-863) vulnerability in Apache Traffic Server that allows remote attackers to bypass IP-based access controls. The flaw stems from faulty ACL matching logic and incorrect handling of IP access controls on Unix Domain Socket (UDS) listeners, enabling requests that should be denied to reach protected resources. It carries a CVSS v3.1 base score of 8.2 (High).

CVE-2026-58189 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Traffic Server caused by a redirect-limit bypass. When plugins reset the internal retry counter, the configured redirect limit can be circumvented, enabling SSRF amplification against back-end or third-party services. The issue is rated HIGH severity (CVSS v3.1 base score 7.5).

CVE-2026-58164 is a use-after-free vulnerability (CWE-416) combined with a time-of-check/time-of-use (TOCTOU) race condition in the remap configuration handling of Apache Traffic Server. A remote, unauthenticated attacker can exploit the flaw over the network to disrupt availability, resulting in a high-severity (CVSS 7.5) denial-of-service condition.

CVE-2026-58177 is a set of memory-safety and path-traversal flaws in the Cripts scripting framework of Apache Traffic Server. The issues include out-of-bounds writes (CWE-787), path traversal, and use-after-free errors affecting Apache Traffic Server versions 10.0.0 through 10.1.3. It carries a CVSS v3.1 base score of 8.1 (HIGH).

CVE-2026-58188 is a memory-safety and limit-bypass vulnerability affecting several experimental plugins shipped with Apache Traffic Server. The flaw is classified as an out-of-bounds write (CWE-787) and is remotely exploitable over the network without authentication or user interaction, carrying a CVSS v3.1 base score of 8.2 (HIGH).

CVE-2026-58179 is a stack-based buffer overflow (with associated integer overflow) in the regex_remap plugin of Apache Traffic Server. When the plugin builds a substitution string from crafted input, it overflows the stack and mishandles integer arithmetic on the substitution input, leading to memory corruption. The issue is rated HIGH severity (CVSS v3.1 base score 8.1) and is remotely reachable over the network.

CVE-2026-58157 is an information-disclosure vulnerability in Apache Traffic Server caused by improper reuse of server sessions and tunnels, which can expose data across separate client connections. An unauthenticated, network-based attacker may be able to obtain sensitive information belonging to other clients. The issue is rated HIGH severity with a CVSS v3.1 base score of 8.7.

CVE-2026-58178 is an uncontrolled recursion vulnerability (CWE-674) in the Edge Side Includes (ESI) plugin of Apache Traffic Server. A remote, unauthenticated attacker can leverage the plugin to recursively fetch attacker-controlled URLs without bounds, exhausting server resources and resulting in a denial-of-service condition. The issue carries a CVSS v3.1 base score of 7.5 (HIGH).

CVE-2026-58184 is an out-of-bounds write (memory corruption) vulnerability in the header_rewrite plugin of Apache Traffic Server. A remote, unauthenticated attacker can trigger crashes or memory corruption through malformed input processed during cookie operations and CIDR condition matching, resulting primarily in denial of service. The Apache Software Foundation rates it HIGH severity (CVSS v3.1 base score 8.2).

CVE-2026-58154 is a high-severity memory corruption vulnerability (CWE-787: Out-of-Bounds Write) in Apache Traffic Server (ATS), the open-source reverse proxy and HTTP caching server published by the Apache Software Foundation. The flaw is triggered during MIME and HTTP header parsing, where ATS can write out of bounds or overflow integers when processing crafted header input. With a CVSS v3.1 score of 8.9 (HIGH), the vulnerability requires no authentication and no user interaction, and carries a changed scope — meaning it can affect resources beyond the vulnerable component itself.

CVE-2026-58153 is an HTTP response smuggling vulnerability (CWE-444) in Apache Traffic Server (ATS), affecting versions 10.0.0 through 10.1.3. During HTTP/2-to-HTTP/1 protocol conversion, ATS incorrectly forwards HTTP/2 origin trailers to downstream HTTP/1 clients without applying proper chunked transfer-encoding framing. The vulnerability carries a CVSS v3.1 score of 8.3 (High) and is exploitable remotely without authentication or user interaction.