Most recent entries from nvd

CVE-2026-94422 — xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

Fri, 02 Oct 2026 13:54:10 +0000

Affected: xdg-dbus-proxy, Fedora, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

CVE-2026-93875 — JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter

Fri, 02 Oct 2026 13:29:05 +0000

Affected: Crocoblock JetAppointment

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.

CVE-2026-85215 — SQL Injection in GG Soft's Paperwork

Fri, 02 Oct 2026 13:01:52 +0000

Affected: GG Soft Software Services Inc. Paperwork

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection.

This issue affects Paperwork: through 2026-09-09.

CVE-2026-19652 — Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

Fri, 02 Oct 2026 13:29:05 +0000

Affected: DiviEngine Divi Membership

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowed roles. This makes it possible for unauthenticated attackers to register a new account with the administrator role by submitting a locally computed bcrypt hash of `administrator` as `form_id`, and when `auto_login=on` is submitted, be immediately authenticated as that administrator in the same request, resulting in full site takeover. Exploitation requires a WordPress nonce, but that nonce is publicly emitted on any page rendering the Divi Membership registration form and is therefore obtainable by any unauthenticated visitor.

CVE-2026-104721 — Logback: Incomplete protection against CVE-2026-19880

Fri, 02 Oct 2026 13:21:59 +0000

Affected: QOS.CH Sarl Logback-classic

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.

CVE-2026-104614 — CodeAstro Simple Pharmacy Management System delete.php sql injection

Fri, 02 Oct 2026 14:00:09 +0000

Affected: CodeAstro Simple Pharmacy Management System

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVE-2026-104613 — CodeAstro Simple Pharmacy Management System view.php sql injection

Fri, 02 Oct 2026 13:15:07 +0000

Affected: CodeAstro Simple Pharmacy Management System

A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-96289 — Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard

Fri, 02 Oct 2026 12:07:02 +0000

Affected: Apache Software Foundation Apache Thrift

Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96287 — Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadrati…

Fri, 02 Oct 2026 12:05:59 +0000

Affected: Apache Software Foundation Apache Thrift

Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96286 — Apache Thrift: Perl servers end `serve()` when serving one connection fails

Fri, 02 Oct 2026 12:04:28 +0000

Affected: Apache Software Foundation Apache Thrift

Uncaught exception vulnerability in Apache Thrift Perl bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.