A Cross-Site Request Forgery (CSRF) vulnerability exists in Xpro Elementor Addons (xpro-elementor-addons) affecting versions up to 1.7.10. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability has a high severity score of 8.8 (CVSS 3.1).
A missing authorization vulnerability exists in DigitalME eRoom eroom-zoom-meetings-webinar, affecting versions up to 1.7.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No known exploits are currently reported in the wild. There is no information about available patches or fixes at this time.
A stored cross-site scripting (XSS) vulnerability exists in the WPVibes Elementor Addon Elements plugin up to version 1.14.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The issue has a medium severity rating with a CVSS score of 6.5.
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.
This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected.
Users are recommended to upgrade to version 5.3.0, which fixes this issue.
CVE-2026-114460 is an off-by-one pointer calculation error in the pbuchbinder mod_qos module. This flaw occurs when merging request body parameters with an existing URL query string, causing truncation of the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker can exploit this to bypass configured security rules by submitting crafted requests that conceal prohibited values from inspection. The vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-114459 is a low-severity vulnerability in the pbuchbinder mod_qos module where improper boundary checking during HTTP response body inspection can lead to out-of-bounds reads. An unauthenticated remote attacker can exploit this flaw by triggering crafted server responses, causing an Apache worker process to crash and resulting in a denial of service. The vulnerability affects specific versions 11.74, 11.76, and 11.79 of mod_qos. There is no indication of data confidentiality or integrity impact, and no known exploits in the wild have been reported. The CVSS score is 3.7, reflecting low severity due to the requirement for high attack complexity and no privileges or user interaction needed.
CVE-2026-114458 is a medium severity vulnerability in the pbuchbinder mod_qos module. It allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by exploiting an out-of-bounds write when connection rate monitoring is enabled. The module fails to properly check array boundaries when recording client IP addresses, leading to heap memory corruption and potential web server crashes. The vulnerability affects versions 11.74, 11.76, and 11.79 of mod_qos.
CVE-2026-114457 is a vulnerability in the pbuchbinder mod_qos module where improper null termination during processing of percent-encoded JSON input can cause an Apache worker process to crash. This flaw allows an unauthenticated remote attacker to trigger a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. The issue results from reading past allocated memory boundaries due to improper string termination.
The net-codec-testmetest npm package version 1.0.1 contains malicious code that abuses the node-gyp build process to execute an obfuscated payload during installation. This payload decrypts and decompresses an embedded binary, which is then executed under the Bun runtime. The package serves as a dropper with no legitimate functionality, designed to stealthily execute arbitrary code on the host system.
The npm package 'log-rotate-testmetest' version 1.0.1 contains malicious code embedded in its binding.gyp file that triggers execution of an obfuscated payload during installation. This payload uses multiple layers of obfuscation including ROT cipher, AES-128-GCM decryption, and brotli decompression, ultimately executing attacker-controlled code via the Bun runtime. The package declares Bun as a runtime dependency to route execution through an alternate runtime rather than Node.js. There is no legitimate native build rationale for this behavior, indicating deliberate malicious intent.
The npm package 'formatting-subtitles' version 1.0.2 contains malicious code in its preinstall script. The script masquerades as JavaScript but is executed by the shell, which runs attacker-controlled commands. During installation, it fetches and executes arbitrary code from a mutable GitHub Gist and sends installation metadata to an attacker-controlled webhook. This behavior allows remote code execution and data leakage during npm install.
The npm package @conduitops/logview-archive version 1.0.1 contains malicious code that executes during installation. Its postinstall script runs install.js, which installs another package from a concealed, non-public HTTP registry controlled by an attacker. This allows arbitrary code execution on the installer's system at install time. The package deliberately obfuscates the malicious registry URL using base64 and XOR encoding to hide the attacker's endpoint.
The npm package simplewave version 0.0.2 contains malicious code that executes a postinstall script during installation. This script performs an HTTP GET request to a subdomain of oast.fun, embedding the installer's hostname in the request, thereby exfiltrating the host identifier to a third-party server without user consent. The package's main file is a trivial stub with no legitimate functionality, indicating the primary purpose is data exfiltration.
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
The MasterStudy LMS WordPress plugin versions before 3.7.55 contain a vulnerability in the student-enrolment feature where the plugin does not verify that a user targeted by an instructor has any relationship to that instructor. This flaw allows users with the Instructor role to overwrite the first name, last name, and public display name of any registered user, including administrators, which could enable impersonation and phishing attacks.
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.