New CVEs.

Remote Code Execution in CGM CLININET

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.  The vulnerability was confirmed to affect versions up to 2026.M…

Published Oct 23, 2026 by CERT-PL · CVSS 4.0 · CWE-250 · NVD · Advisory

Code Injection in CGM CLININET

CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges.  The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

Published Oct 23, 2026 by CERT-PL · CVSS 4.0 · CWE-94 · NVD · Advisory

Missing Authentication in CGM CLININET

CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents.  This issue was fixed in version 2026.MS3

Published Oct 23, 2026 by CERT-PL · CVSS 4.0 · CWE-306 · NVD · Advisory

KNIME Analytics Platform logs credentials of configured proxy when used as an executor

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

Published Oct 23, 2026 by KNIME · CVSS 4.0 · CWE-532 · NVD · Advisory

WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-89 · NVD · Advisory

WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-502 · NVD · Advisory

WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-79 · NVD · Advisory

WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-89 · NVD · Advisory

WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-862 · NVD · Advisory

WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-79 · NVD · Advisory

WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-862 · NVD · Advisory

WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

Published Oct 23, 2026 by Patchstack · CVSS 3.1 · CWE-862 · NVD · Advisory

Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the …

Published Oct 23, 2026 by SEC-VLab · CVSS 4.0 · CWE-79 · NVD · Advisory

Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL. JavaScript code placed in this parameter is executed in the victim's browser. An unauthenticated attacker who knows t…

Published Oct 23, 2026 by SEC-VLab · CVSS 4.0 · CWE-79 · NVD · Advisory

Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the correspo…

Published Oct 23, 2026 by SEC-VLab · CVSS 4.0 · CWE-79 · NVD · Advisory

Authentication Bypass Vulnerability

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform.

Published Oct 23, 2026 by CSA · CVSS 3.1 · NVD · Advisory

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Published Oct 23, 2026 by ASUS · CVSS 4.0 · CWE-78 · NVD · Advisory

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Published Oct 23, 2026 by ASUS · CVSS 4.0 · CWE-287 · NVD · Advisory

Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more inf…

Published Oct 23, 2026 by ASUS · CVSS 4.0 · CWE-78, CWE-352 · NVD · Advisory

Firmware verification vulnerability

An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication.

Published Oct 23, 2026 by CSA · CVSS 3.1 · NVD · Advisory

Firmware verification vulnerability

A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device.

Published Oct 23, 2026 by CSA · CVSS 3.1 · NVD · Advisory

Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over…

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execu…

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led …

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-a…

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warn…

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-…

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrat…

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site o…

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory

Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

Published Oct 23, 2026 by WPScan · CVSS 3.1 · NVD · Advisory