Threat database

CVE-2026-107213 is a high-severity vulnerability in the qax-os excelize Go library versions 2.9.0 through 2.11.0. The flaw is a NULL pointer dereference caused by the GetSlicers function accessing a worksheet drawing element without verifying its existence. This can cause the application to panic and terminate when processing a crafted Excel worksheet containing an extLst element but lacking the drawing element. No fix is currently available for this issue.

A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size

CVE-2026-106066 is a heap-based buffer overflow vulnerability in the GIMP raw data export plug-in on Red Hat Enterprise Linux 10. The issue arises when exporting very large images, where an integer overflow in memory allocation causes insufficient memory to be allocated, leading to out-of-bounds reads or writes during export. This can result in integrity and availability impacts.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.

CVE-2026-92542 is a medium severity vulnerability in Docker Engine related to firewall rules that indiscriminately mark VXLAN datagrams for encryption. Both authentic VXLAN datagrams from the kernel and forged datagrams from user processes are matched, causing any UDP packet sent from the host network namespace that meets certain criteria to be encrypted with overlay-network IPsec parameters. This affects multiple Docker Engine versions prior to 25.0.19, between 26.0.0 and 29.8.2, and some beta versions. The vulnerability has a CVSS 4.0 score of 6.9 and does not have known exploits in the wild. Patch status is not confirmed from the provided data.

CVE-2026-107211 is a high-severity vulnerability in the qax-os excelize library involving improper validation of array indices when processing pivot tables in .xlsx files. The vulnerability arises because the library indexes arrays with attacker-controlled integers from pivot table XML parts without bounds checking, leading to runtime panics (index out of range errors). This can cause the host process to crash when opening crafted malicious Excel files containing pivot tables. The issue affects versions from 2.8.1 through 2.11.0. No official patch or fix is currently documented.

CVE-2026-96335 is a Missing Authorization vulnerability in the WPMU DEV Forminator plugin. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability affects Forminator versions up to and including 1.57.2. The CVSS v3.1 base score is 7.5, indicating a high severity issue with no required privileges or user interaction for exploitation. No patch or official remediation information is currently provided.

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.

CVE-2026-95595 is a reflected cross-site scripting (XSS) vulnerability in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' (Fontsplugin). This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. It affects versions up to and including 2.0.2. The vulnerability has a high severity with a CVSS score of 7.1.

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation

A stored cross-site scripting (XSS) vulnerability exists in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) up to version 2.0.19. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity.