Siyuan Note, WP Plugins, Scriban Hit By Critical Flaws
Siyuan Note, WordPress plugins, and Scriban face critical vulnerabilities including auth bypass, RCE, XSS, and file upload flaws.
Multiple vulnerabilities have been disclosed in Siyuan Note, a note-taking application, affecting versions prior to 3.7.4. These include improper restriction of excessive authentication attempts (CVE-2026-73046, CVE-2026-73056), leading to authentication bypass. Additionally, several cross-site scripting (XSS) vulnerabilities exist due to insufficient sanitization in functions like unicode2Emoji (CVE-2026-73053), direct interpolation of field names into HTML (CVE-2026-73052), and improper handling of table column widths (CVE-2024-13784) and annotation fields (CVE-2026-73041). These flaws could allow attackers to execute arbitrary JavaScript or gain unauthorized access.
A critical PHP Object Injection vulnerability (CVE-2024-13784) has been identified in the ARForms WordPress plugin, affecting all versions up to 1.8.5. This flaw arises from the deserialization of untrusted input from form submissions, potentially enabling attackers to execute arbitrary PHP code on the affected WordPress site. As reported by Vypr Intelligence, this is one of 25 vulnerabilities disclosed in WordPress plugins within a single batch.
The Scriban templating engine has several vulnerabilities disclosed, impacting versions prior to 7.2.2. CVE-2026-73061 details an access-modifier bypass in TypedObjectAccessor, allowing template code to write to CLR object properties regardless of their visibility, including private and internal properties. Additionally, CVE-2026-74791 describes a flaw where cached templates persist across reused contexts due to a failure to clear the CachedTemplates dictionary during context resets, which could be exploited by attackers manipulating template loading. Vypr Intelligence notes these are among fifteen recursion, DoS, and access control flaws.
Several critical vulnerabilities have been found in various WordPress plugins. The Frontend Admin by DynamiApps plugin (up to 3.29.9) suffers from a privilege escalation flaw (CVE-2026-18432) due to insufficient checks on user capabilities. The ProSolution WP Client plugin (up to 2.0.10) has an arbitrary file upload vulnerability (CVE-2026-16098) stemming from a lack of validation on uploaded content. Furthermore, the Royal Elementor Addons plugin (up to 1.7.1064) contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-17123) in its Form Builder widget, allowing for requests to arbitrary URLs.
Tenda AC10 routers running firmware version 16.03.10.09_multi_TDE01 are affected by an improper authentication vulnerability (CVE-2026-19924) within the httpd component's R7WebsSecurityHandler function. This could allow remote attackers to bypass authentication mechanisms. Additionally, two high-severity vulnerabilities in LB-LINK X-PRO firmware version 1.0.22-20231206 involve hard-coded credentials in the /etc/config/easycwmp file (CVE-2026-19901) and the /etc/shadow file (CVE-2026-19900), both exploitable remotely.
Pandora analysis software has disclosed two vulnerabilities. CVE-2026-74764 is a path traversal flaw in its TAR archive extraction functionality, where archive member names are not properly sanitized before extraction, potentially allowing access to arbitrary files. CVE-2026-74767 is a denial-of-service vulnerability related to the handling of DAA files, where compressed chunks are decompressed without proper size enforcement, potentially leading to excessive resource consumption.
A symlink following vulnerability (CVE-2026-13622) has been identified in KubeVirt's virt-handler during live migration. The migration proxy attempts to access target virt-launcher pods via /proc/<pid>/root/ paths without properly handling symlinks, which could lead to unintended file access or manipulation. Separately, a flaw in openshift/oauth-proxy (CVE-2026-49332) allows the proxy to forward requests with underscore-variant identity headers (e.g., X_Forwarded_User) even though it only processes dash-variant keys (X-Forwarded-User), potentially leading to incorrect user authentication.
A Remote Code Execution (RCE) vulnerability (CVE-2026-14498) exists in the Query Wrangler WordPress plugin, affecting versions up to 1.5.57. This is due to missing capability checks and nonce verification in the wp_ajax_query_wrangler_save_options AJAX action, allowing unauthenticated users to execute arbitrary code.