35
42
35
Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server
Payara Server 7.2026.1.RC1 HTTP EJB endpoints rely on attacker-controlled reflection and JNDI lookups without authorization, enabling arbitrary EJB method invocation.
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that depend on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction. Both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1.
33
30
30
CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
Apache Syncope Console and Enduser UIs suffer unauthenticated reflected XSS via notification messages, affecting versions 4.0.4 through 4.1.2.
CVE-2026-78318 is a moderate-severity cross-site scripting flaw in Apache Syncope's syncope-client-idrepo-common-ui module. The notification message, optionally shown by the Console and Enduser UIs, is improperly neutralized, enabling unauthenticated reflected XSS. Affected versions are 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2; no exploitation is reported.
25
60
35
30
35
42
55
55
30
New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks
60
55
30
30
55
55
60
30
30
47
47
55
47
35
30
30
55
60
55
35
30
30
55
55
30