Live threat intelligence radar

CVE-2024-9341 concerns a directory mounting issue related to FIPS crypto-policy in the containers/common Go library used by Podman, buildah, and cri-o. The vulnerability involves improper handling of the crypto-policy directory, potentially leading to security risks. No CVSS score or detailed impact information is provided. No known exploits or patches are currently documented.

CVE-2024-11218 is a vulnerability in Podman buildah that allows container breakout by exploiting a race condition when using the --jobs=2 option during the build of a malicious containerfile. The flaw relates to improper access control (CWE-269).

CVE-2026-119601 is a heap out-of-bounds write vulnerability in AFFLIB version 3.0, specifically in the af_get_page function. This type of flaw can lead to memory corruption, potentially causing crashes or enabling further exploitation. No CVSS score or detailed impact information is provided.

The MapPress WordPress plugin versions before 2.97.15 have a vulnerability where the front-end map embed handler does not restrict access to user data. This flaw allows unauthenticated visitors to enumerate user IDs and retrieve email addresses and display names of any user on the site.

The Kali Forms WordPress plugin before version 2.4.30 has a vulnerability where its test-email handler does not perform proper capability checks. Instead, it relies solely on a nonce accessible to any logged-in user, allowing low-privileged users such as Subscribers to send emails from the site with arbitrary recipients and spoofed sender addresses.

A critical OS command injection vulnerability exists in the WAVLINK WL-WN530HG4B M_V260724 router, specifically in the port_forward function of /cgi-bin/wapi.cgi. This flaw allows remote attackers with low privileges to execute arbitrary OS commands by manipulating the Name argument. Exploit code has been published, increasing the risk of exploitation. No patch or remediation information is currently available.

The Media Library Assistant WordPress plugin versions before 3.44 have a vulnerability where the plugin does not verify if the requesting user has permission to view a post before revealing the taxonomy terms assigned to it. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to discover the term assignments of private attachments and posts.

A critical command injection vulnerability exists in WAVLINK WL-WN530BE1-A version V251117 in the function con_check_read_finish of the file /protocol.csp. The vulnerability allows remote attackers to execute arbitrary commands by manipulating the argument group_name/IP-FROM. Public exploit code has been disclosed. No patch or remediation information is currently available.

A stored cross-site scripting (XSS) vulnerability exists in the Media Library Assistant WordPress plugin versions before 3.44. The flaw arises because one of the plugin's shortcode attributes is not properly escaped before being output in an attribute of generated links. This allows users with Contributor role or higher to inject malicious scripts that persist and execute in other users' browsers.

The Kali Forms WordPress plugin before version 2.4.30 contains a vulnerability where its test-email handler does not perform proper capability checks. This flaw allows any authenticated user with minimal privileges (Subscriber and above) to disclose the email addresses of any registered user, including administrators, by exploiting a nonce that is accessible to all logged-in users.