Threat database

CVE-2026-97315 is a vulnerability in the Responsive Blocks WordPress plugin before version 2.3.0. It allows unauthenticated users to inject arbitrary HTML into notification emails sent to site owners via the Form block. This occurs because some submitted values are not properly sanitized or escaped before inclusion in the email content.

The Tickera WordPress plugin versions before 3.6.0.4 contain a vulnerability where incoming payment notifications are not properly verified. The signature validation does not cover critical fields such as the order or payment amount, enabling attackers to forge payment confirmations and mark orders as paid without actual payment.

WPForms Lite versions from 1.10.0.1 up to but not including 2.0.2.2 contain a vulnerability where the plugin does not verify server-side that a PayPal payment was completed before accepting form submissions. This allows unauthenticated users to submit forms that require payment without actually paying, triggering confirmation messages and notification emails despite no payment being recorded.

Visma Pay for WooCommerce versions before 1.2.2 contain a vulnerability where the plugin does not verify the authenticity of payment gateway return requests if the merchant secret is empty. This allows unauthenticated attackers to mark arbitrary orders as paid and access customer information such as name, email, and postal address.

CVE-2026-101301 is a medium severity vulnerability in the WPCode WordPress plugin versions 2.0.0 up to but not including 2.4.0. The plugin fails to properly verify that a request is for the login screen before enabling snippet safe mode, which allows unauthenticated visitors to disable all automatically inserted snippets on the site for their own requests.

CVE-2026-103904 is a high-severity cross-site scripting (XSS) vulnerability in JTL-Shop by JTL-Software GmbH. The issue arises because the public consent endpoint accepts arbitrary consent names from unauthenticated users without validation. These names are stored and later rendered without proper output encoding in the administration backend. This allows an unauthenticated attacker to inject malicious script code that executes in the browser session of an administrator viewing the consent statistics page, potentially enabling actions with administrator privileges.

CVE-2026-73795 is a stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop TMF Auditread2 component. This vulnerability can lead to a denial of service condition. The CVSS 3.1 base score is 6.4, indicating a medium severity level. The attack vector is local with high attack complexity and requires low privileges. There is no indication of confidentiality impact, but integrity and availability impacts are present. No patch or remediation information is currently available.

CVE-2026-100229 is an out-of-bounds write vulnerability in the GStreamer H.266 codec parser library (libgstcodecparsers) on Red Hat Enterprise Linux 10. The flaw occurs in the DCI parsing function, where a reserved field value is improperly accepted, leading to memory corruption. Exploitation requires a specially crafted H.266 bitstream provided to a third-party application using this library API. No standard GStreamer pipeline element currently triggers the vulnerable code path. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-88842 is a low-severity vulnerability in BusyBox's dpkg component used in Red Hat Hardened Images. The issue occurs because the write_status_file() function does not reset a field cursor between package stanzas, which can cause the second package stanza to be dropped from the status file when removing two packages in a single operation if the first stanza is larger. This results in limited data corruption but no direct impact on confidentiality, availability, or privilege escalation.

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

CVE-2026-109970 is a medium severity vulnerability in Red Hat Enterprise Linux 10 involving the clevis PKCS#11 pin handling. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file with world-readable permissions due to the default umask. Additionally, the PIN file may not be cleaned up if the decryption script exits prematurely, leaving sensitive information accessible indefinitely.

CVE-2026-109969 is a vulnerability in the clevis PKCS#11 pin component of Red Hat Enterprise Linux 10. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without enforcing permission restrictions or verifying peer credentials. This allows any local user, under permissive process umask settings, to connect to the control socket and inject arbitrary device or key pairs, or connect to the data socket to receive LUKS passphrases. The vulnerability has a medium severity with a CVSS score of 4.7.

CVE-2026-100231 is a medium severity vulnerability in the GStreamer ASF muxer plugin used in Red Hat Enterprise Linux 10. The flaw causes an out-of-bounds heap write when writing Unicode metadata tags containing non-Basic Multilingual Plane characters (e.g., emoji) to ASF containers. This occurs due to incorrect buffer size calculation for UTF-16LE encoding, potentially leading to denial of service or limited memory corruption.

CVE-2026-88829 is a vulnerability in BusyBox httpd's reverse proxy feature used in Red Hat Hardened Images. The flaw causes only the first HTTP request on a TCP connection to have its path rewritten, allowing subsequent pipelined requests to bypass path restrictions and access unintended backend paths.

CVE-2026-90954 is a high-severity vulnerability in BusyBox's dpkg-deb archive extraction used in Red Hat Hardened Images. It involves improper link resolution before file access during extraction of specially crafted .deb packages. An attacker can exploit the handling of deferred symlinks to write arbitrary files outside the intended extraction directory, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-86476 is a heap buffer overflow vulnerability in gst-plugins-base on Red Hat Enterprise Linux 10. It occurs when video buffers with GstVideoMeta metadata declare plane strides and offsets that exceed the actual memory allocation, leading to out-of-bounds writes. A local attacker controlling the sending side of a GStreamer IPC pipeline can exploit this flaw to cause denial of service or potentially execute code within the affected process.

CVE-2026-73794 is a medium severity vulnerability in Hewlett Packard Enterprise's HPE NonStop MODULAR NSJ involving a predictable seed in its pseudo-random number generator (PRNG). This weakness could reduce the randomness of generated values, potentially impacting confidentiality, integrity, and availability. No affected versions or patches are specified in the available data.

CVE-2026-73793 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop Middleware involving deserialization of untrusted data and secret key handling issues. It allows an attacker with high privileges to potentially impact confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 score of 7.9, indicating significant risk. No affected versions or patch information are provided in the available data.

CVE-2026-73792 is a security vulnerability in Hewlett Packard Enterprise's HPE NonStop Java JToolkit involving improper neutralization of special elements used in OS commands, leading to potential OS command injection and buffer overflow. The vulnerability has a CVSS score of 3.8, indicating low severity. No affected versions or patch information are provided.

CVE-2026-73791 is a heap-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop Hpjmeter. The flaw can cause both stack and heap buffer overflows. The CVSS score is low, indicating limited impact, with no confidentiality or integrity impact and only low impact on availability. There are no known exploits in the wild and no patch information is provided.