CVE-2026-90446

Jumis (formerly Tildes Jumis) creates a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input — the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and identical across every installation, and it contains a hard-coded secret key. Because the only input (the server name) is not secret, anyone able to reach a Jumis SQL Server can compute the password offline and authenticate.

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8. Unauthenticated attackers can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability is exploited via a two-step chain: storing an arbitrary ticket_attachment_path value through the public AJAX endpoint, then triggering the factory_reset routine via a GET request.

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. Unauthenticated attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges. Exploitation requires "Anyone can register" enabled and at least one public BuddyForms form attached to a page.

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow.

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators.

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.

Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.