CVE-2026-118697

The LeadSnap WordPress plugin in versions up to 1.25 contains an unauthenticated PHP Object Injection vulnerability.

The FunnelKit Automations WordPress plugin in versions up to 3.8.6.1 contains an unauthenticated PHP Object Injection vulnerability.

The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.

The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.

The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.

The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.

Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, allowing anonymous callers to perform configuration-mutating operations such as logging out the Plex integration, persisting an attacker-selected API key, binding an attacker-controlled Plex account token, and other `write_config()` operations. Missing OAuth state validation and attacker-controlled server URLs further enable server-side request forgery and credential exposure.

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability. Attackers can send a base64-encoded crafted pickle in serialized_named_tensors to the /update_weights endpoint, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

A deserialization of untrusted data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. The vulnerability was patched on 11 September 2026.