CVE-2026-90601

The Contact Manager plugin for WordPress in versions up to and including 9.1.2 is vulnerable to arbitrary file upload via the add_message function. An incomplete extension blacklist allows bypassing validation with a trailing dot, enabling unauthenticated attackers to upload executable files and potentially achieve remote code execution.

Improper Control of Generation of Code in the Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection.

The Pie Register Premium plugin for WordPress up to and including 3.8.4.0 is vulnerable to unrestricted file type upload via the piereg_file_upload function. File type validation errors are not checked before move_uploaded_file(), and the AJAX handler lacks nonce and capability checks, allowing unauthenticated attackers to upload PHP files and achieve remote code execution.

The Jupiter X Core plugin for WordPress (up to and including 4.61.0) is vulnerable to authentication bypass in its Twitter/X social login handler. The verify_twitter_callback function fails to reassign the returned credentials to the TwitterOAuth client, so the subsequent API call remains signed with the site operator's stored token, and the plugin authenticates a WordPress account based solely on the X app owner's email address.

A vulnerability in jackson-databind allows bypassing generic-argument validation: only the outer class of a type ID is checked, while attacker-selected classes inside generic arguments are accepted. This enables deserialization of dangerous classes (e.g., HashMap<FileSystemXmlApplicationContext,String>) even with a validator enabled, potentially leading to remote code execution. Affects versions 2.10.0+ and 3.0.0+; it is an incomplete fix for CVE-2026-54512.

In GRR prior to version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and enabling remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page.

In MLflow from 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of allowed modules rather than requiring an exact allowed module. An attacker can place a Python module under a writable allowed package and invoke it via /ajax-api/3.0/mlflow/scorer/invoke, leading to code execution. Version 3.17.0 fixes the issue.

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker-supplied data may result in memory corruption, denial of service, or potential remote code execution.