A stored cross-site scripting (XSS) vulnerability exists in WP Mailster through version 1.9.1.0. This vulnerability results from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 7.1.
A stored cross-site scripting (XSS) vulnerability exists in H5P through version 1.17.9 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No patch or remediation details are provided in the available data.
A missing authorization vulnerability exists in ACF Extended up to version 0.9.2.7. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive data. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable conditions without privileges or user interaction. No patch or remediation information is currently available.
ACF Extended versions up to 0.9.2.7 are affected by a Path Traversal vulnerability that allows improper limitation of pathnames to restricted directories. This vulnerability can lead to limited integrity and availability impacts without confidentiality loss. The CVSS score is 6.5, indicating a medium severity level. No patch or remediation information is currently provided.
A vulnerability in the OpenVPN 3 Core library versions 3.4 through 3.11.7 allows attackers to bypass extended key usage restrictions due to improper certificate validation.
A vulnerability in Pillow's libtiff encoder allows crafted TIFF files to cause memory disclosure or process crashes during TIFF re-saving. The flaw arises from a mismatch between Pillow's argument passing to libtiff's TIFFSetField() and libtiff's internal tag definitions, leading to reading unintended memory or segfaults. This occurs when Pillow forwards unrecognized TIFF tags from the source file without properly consulting libtiff's field table. The issue affects applications that open and then save TIFF images, especially when metadata is preserved. No out-of-bounds writes were observed, only reads. The vulnerability was introduced in Pillow 5.4.0 and affects versions from 0.86.1_1 onward as per the provided data.
GitLab has fixed 12 vulnerabilities in both the Community Edition (CE) and Enterprise Edition (EE) versions. Among these, one vulnerability is rated as critical. The affected versions span from 7.0 up to certain 19.x releases. No CVSS score is provided for these vulnerabilities. There are no known exploits in the wild reported at this time.
HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.
CVE-2026-21811 is an information disclosure vulnerability in HCL AppScan Azure Boards Plugin that may expose secrets in plaintext during pipeline execution. These secrets can be revealed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface. The vulnerability has a low severity rating and requires privileged access to exploit.
A stored cross-site scripting (XSS) vulnerability exists in hupe13 Extensions for Leaflet Map through version 6.0. This vulnerability involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of affected users. The issue has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No specific patch or remediation details are provided in the available data.
A stored cross-site scripting (XSS) vulnerability exists in nicdark ND Shortcodes For Visual Composer up to version 7.8. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
A stored cross-site scripting (XSS) vulnerability exists in the xootix Waitlist Woocommerce (Back in stock notifier) plugin, affecting versions up to 2.9.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to inject malicious scripts. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
A stored cross-site scripting (XSS) vulnerability exists in Gloriafood Restaurant Menu – Food Ordering System – Table Reservation versions up to 2.4.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. The issue is rated medium severity with a CVSS score of 6.5.
A missing authorization vulnerability exists in yoomoney ЮKassa для WooCommerce yookassa, affecting versions up to 2.17.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or remediation information is currently available.
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.
Users of the affected version should apply the following mitigation.
Product version
com.vaadin.external.google:android-json 0.0.20131108.vaadin1
Mitigation
No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.
Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none
A vulnerability in WP Desk ShopMagic for WooCommerce (up to version 4.9.1) allows insertion of sensitive information into files or directories accessible externally. This could lead to unauthorized retrieval of embedded sensitive data. The issue is identified as CWE-538 and has a medium severity with a CVSS score of 5.3.
A missing authorization vulnerability exists in Ahmad Majestic Support (majestic-support) up to version 1.2.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact data integrity. The vulnerability has a medium severity with a CVSS score of 5.3 and does not affect confidentiality or availability. No patch or remediation information is currently provided.
A missing authorization vulnerability exists in the miniOrange Page Restriction WordPress plugin (page-and-post-restriction) up to version 1.6.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially permitting unauthorized access to restricted content. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or remediation details are provided in the available data.
A missing authorization vulnerability exists in WP Sunshine Sunshine Photo Cart up to version 3.7.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation information is currently provided.
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.