CVE-2026-13766

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a blind SQL injection vulnerability. An attacker can exploit this flaw to manipulate database queries without knowing the database structure.

A code injection vulnerability was found in InternLM MindSearch 0.1.0 in the ExecutionAction.run function in mindsearch/agent/graph.py. The attack can be launched remotely, and exploit details have been publicly disclosed.

An OS command injection vulnerability was found in AhsayCBS up to version 10.3.2 in the file /rps/api/json/UpdateReceivers.do. The attack can be launched remotely, and the exploit has been published. Upgrading to version 10.3.4 resolves the issue.

Missing authentication for critical function in the ait-server telemetry and command broker in NASA-AMMOS AIT-Core through 3.1.1. An unauthenticated remote attacker with network access to the ZeroMQ message bus can inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the bus. The ZeroMQ broker binds XSUB and XPUB sockets to all interfaces by default without authentication.

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. An attacker could present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that other party's identity through KeyPackage.verify() and the Group leaf-validation path.

The Beaver Builder Page Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to arbitrary shortcode execution. This is due to insufficient validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires a page with the Sidebar module containing a widget that displays attacker-controlled text, such as the Recent Comments widget with approved comments.

The VikAppointments Services Booking Calendar plugin for WordPress up to version 1.2.21 is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution (e.g., by deleting wp-config.php). Exploitation requires at least one File-type custom field published on the confirmation page.

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files and passes them to the ebook-convert program from Calibre. This allows executable code in .recipe or .downloaded_recipe files.

The web management service in affected RouterOS versions contains an integer underflow in HTTP request body handling that is reachable before authentication. An unauthenticated network attacker can exploit a single crafted request to achieve remote code execution as root or cause a denial of service.

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. By exploiting this weakness, attackers can gain unauthorized access to sensitive data or perform unauthorized actions. Since no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.