2026-10-29
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacker rewrite the plugin's stored settings and turn the site into a delivery point for arbitrary scripts. The configuration-update request is never authenticated; the only gate is a secret that is exposed in public page HTML, so no credentials, user interaction, or non-default configuration is required on any site running an affected version. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the vendor has released a fix in 1.0.25 and the issue was reported by Canva, the plugin's maintainer.
Improper input validation in Samsung Bixby before version 4.0.85.6 allows a local attacker who already holds high privileges on the device to launch arbitrary activities, giving a high impact on confidentiality and integrity and a limited impact on availability. Exploitation is strictly local and gated behind pre-existing elevated privileges, with no user interaction required and no remote or unauthenticated path described in the available sources. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor-reported severity is high (CVSS 8.3) while our assessed CVSS 3.1 vector is 6.5-class local, high-privilege impact; vuln.today prioritizes it as a this-week item rather than an emergency.
XML external entity injection in openEQUELLA before 2026.1 allows an authenticated user who holds the CREATE_ITEM permission to submit crafted item metadata to POST /api/item, causing the server to read files accessible to the openEQUELLA service account and to issue requests to attacker-chosen destinations, including cloud instance metadata services. The flaw is authentication-gated (CVSS:4.0 PR:L, no user interaction) and derives its severity from high confidentiality impact with no integrity or availability effect, plus a scope change because the server, not the attacker's client, performs the file and network access. No public exploit code or PoC has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available in 2026.1.