Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC (DoQ) implementation. This flaw occurs during multi-threaded operation when a client-triggered QUIC path migration causes cleanup of a DoQ stream while a mesh reply still holds a pointer to it. The subsequent dereference of this freed pointer leads to a crash, impacting availability.
NLnet Labs Unbound versions prior to 1.26.2 have a vulnerability where excessive chained compression pointers in DNS messages can cause high CPU usage. This occurs because Unbound limits compression-pointer traversal per domain-name operation but lacks an aggregate inbound decompression-work budget. An attacker with recursive-query access and control over a delegated authority can exploit this to degrade Unbound's performance. The vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or integrity, only availability.
CVE-2026-50106 is a vulnerability in NLnet Labs Unbound up to version 1.26.1 involving reliance on untrusted inputs in security decisions. When configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is insecure, an attacker can deliver a forged NXDOMAIN response that causes Unbound to treat records in the trust island as insecure, denying their existence. This can lead to denial of service for DNS records within the affected trust island.
CVE-2026-35501 is a vulnerability in NLnet Labs Unbound versions 1.0.1 through 1.26.1 where improper validation of DNSSEC integrity check values can cause the DNSSEC validator to incorrectly treat a configured trust island as insecure. This occurs when Unbound is configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is insecure. A malicious actor can exploit this by sending a forged NSEC reply with the SOA bit cleared, causing Unbound to accept and cache the insecure response without proper RRSIG validation.
CVE-2026-109125 is a cache side-channel vulnerability in NLnet Labs Unbound up to version 1.26.1. It arises when the 'unwanted-reply-threshold' configuration is set above zero, which is not the default. An attacker can observe cache clearing behavior triggered by unwanted UDP replies with mismatched TXIDs, allowing inference of the upstream source port. This side-channel can facilitate source port filtering and TXID guessing, potentially enabling cache poisoning attacks. The vulnerability has a medium severity with a CVSS score of 5.3. It is not exploitable under default configurations and is unreliable on public resolvers with high threshold values. No official patch or fix is explicitly stated in the provided data.
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared
and no user interaction beyond launching it, can execute arbitrary shell
commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects
combine: (a) OnePlus's atlasservice binder interface accepts
setEvent(String8 name, String8 value) from any caller without
authorization, and (b) one event handler
(OplusAtlasLogWriter::handleEvent, matching event name
atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value
into the system property oplus.audio.dumpinfo.type and starts the root
init service audiodumpinfo, which passes that property value unsanitized
to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
The SafePay ransomware group has targeted over 600 critical infrastructure organizations worldwide since 2024. This group uses multiple initial access methods including credential exposure, brute force attacks, VPN exploitation, and phishing. SafePay employs double-extortion tactics by stealing sensitive data before encrypting systems and threatening to leak stolen information if ransoms are not paid. The group disrupts recovery by deleting shadow copies and resetting network-attached storage backups. CISA and partner agencies recommend implementing multifactor authentication, restricting administrative privileges, and patching vulnerabilities in VPNs, firewalls, and edge devices to defend against these attacks.
CVE-2026-114236 is a low severity vulnerability in Red Hat Confidential Compute Attestation where certain functions may leak file descriptors when processing corrupt or malicious inputs. This leak can lead to exhaustion of the process' file descriptor limit after repeated calls. No confidentiality or integrity impact is reported, only availability is affected.
Eclipse OpenJ9 versions from 0.8.0 up to but not including 0.63.0 contain a vulnerability in the JITServer component that allows unauthenticated remote attackers or malicious JITServers to cause denial of service. This occurs due to improper boundary checks during protocol message and reply handling, leading to out-of-bounds heap reads and immediate crashes of the JITServer daemon or client JVM process via segmentation faults.
Eclipse OpenJ9 versions prior to 0.63.0 contain a vulnerability in the JITServer component where attacker-controlled fields are not properly validated during DataDescriptor message deserialization. This allows an unauthenticated remote attacker to cause an unsigned integer underflow, leading to out-of-bounds heap reads and an immediate process crash (SIGSEGV), resulting in denial of service.