The AMP for WP plugin for WordPress up to version 1.1.17 is vulnerable to stored cross-site scripting (XSS) via the 'headline-*' shortcode attribute. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Subscriber-level users can exploit this by storing malicious shortcodes in their biographical info fields, bypassing WordPress's HTML tag filtering and AMP content sanitizers.
GNU mtools versions up to 4.0.49 contain an out-of-bounds write vulnerability in the parse_vses function within vfat.c. This flaw can lead to a denial of service or other impacts due to memory corruption. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.
The Pie Register Premium WordPress plugin up to version 3.8.4.0 contains an unrestricted file upload vulnerability via the piereg_file_upload function. The plugin fails to properly verify file type validation results before saving uploaded files and lacks nonce or capability checks on the AJAX handler. This allows unauthenticated attackers to upload and execute malicious files such as PHP scripts, enabling remote code execution. The server response reveals the uploaded file's path, facilitating exploitation.
WeKnora versions prior to 0.8.2 have a server-side request forgery (SSRF) vulnerability in the isRestrictedIP() function. This flaw causes NAT64-prefixed IPv6 addresses to be misclassified as public, allowing authenticated attackers to supply URLs that resolve to internal addresses via web_fetch or URL-based knowledge import. This can enable attackers to access internal services or cloud metadata endpoints.
An out-of-bounds write vulnerability exists in llama.cpp versions from b8841 up to but not including b11865 in the ggml-rpc RDMA transport's rdma_recv() function. This flaw allows unauthenticated peers that advertise RDMA capabilities in the HELLO message to overflow a 1-byte stack variable by sending up to 256 KiB of data, potentially crashing the server or enabling code execution.
LibreSSL ocspcheck versions through 4.4.0 have a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding carriage return and line feed sequences in a certificate's AIA OCSP URI path. This occurs because the function url2host() copies the URI path without filtering control characters, and http_open() includes this path in the POST request line, enabling header injection or request splitting to the OCSP responder.
LibreSSL's ocspcheck utility up to version 4.4.0 has a vulnerability where OCSP requests can be transmitted in cleartext when sent to HTTPS responder URLs on non-standard ports. This occurs because the function url2host() removes the OCSP URL scheme, and http_alloc() only uses TLS for port 443, leading to unencrypted transmission on other ports. As a result, on-path attackers can intercept OCSP requests and access sensitive certificate information such as serial numbers, issuer hashes, and nonces.
LibreSSL ocspcheck versions up to 4.4.0 have a memory exhaustion vulnerability. Malicious OCSP responders can send unbounded HTTP responses, causing the ocspcheck process to consume excessive memory. This can lead to denial of service for certificate status checks when attackers control the responder or intercept unencrypted OCSP traffic.
A vulnerability in a2ui-project a2ui up to version 0.10.6 affects the DataModel.set function in the file renderers/web_core/src/v0_9/state/data-model.ts. This flaw allows remote attackers to cause resource consumption, potentially leading to denial of service. Exploit code has been published. A patch identified by commit 82789191ce551f4d7a095d273773fb24bd764c9d is available to remediate the issue.
CVE-2026-118274 is a medium severity vulnerability in a2ui-project a2ui up to version 0.10.6. It affects an unknown functionality in the Binder component's generic-binder.ts file, leading to resource consumption. The vulnerability can be exploited remotely without user interaction. Public exploit details have been disclosed. A patch identified by commit c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e is recommended to fix the issue.
A signed integer overflow vulnerability exists in libexpat versions through 2.9.0 in the storeAtts() function within lib/xmlparse.c. This flaw allows attackers to cause out-of-bounds writes by supplying XML documents with an excessively large number of attributes, potentially leading to application crashes or heap memory corruption.
GROWI has a vulnerability in its collaborative editing feature where a missing authorization check allows users with read-only or limited statuses to modify page drafts. This affects users including guests and those with pending, suspended, or invited statuses.
Xerte Online Toolkits versions up to 3.15.5 contain a remote code execution vulnerability. Authenticated users with system permissions can exploit this flaw by importing a specially crafted language pack ZIP file containing a .inc file. This file can then be accessed via the language parameter to execute arbitrary PHP code on the server, leading to full compromise.
A NULL pointer dereference vulnerability exists in libexpat through version 2.9.0 within the externalEntityInitProcessor2() function. This flaw mishandles the XML_TOK_NONE token from empty input, allowing attackers who control stream chunking to cause a crash by forcing an empty non-final first parse on an external entity subparser.
LibreSSL versions through 4.4.0 have a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions. This flaw allows attackers to inject carriage return and line feed characters into the OCSP POST request line by embedding them in a certificate's Authority Information Access OCSP URI. The vulnerability could enable injection of HTTP headers or splitting of requests sent to OCSP responders and proxies.
rtl_433 versions through 25.12 have a stack-based buffer overflow vulnerability in the proflame2_mc() function. This flaw allows an attacker within radio range to send more than seven valid Manchester-coded words, overflowing a 7-byte stack buffer. Exploitation can cause rtl_433 to crash and potentially corrupt stack memory, enabling control-flow hijacking on builds lacking stack canaries.
Assimp versions through 6.0.5 have an integer overflow vulnerability in the MD2Importer::ValidateHeader() function. This flaw allows attackers to craft malicious .md2 files with manipulated header fields that bypass frame table bounds checks. Exploiting this can cause heap out-of-bounds reads, potentially crashing applications or exposing adjacent heap memory.
NexoPOS versions through 6.3.0 have a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions. This occurs because the CashRegistersService does not verify that the user performing actions on a register session matches the session's assigned user. Attackers with the default permission nexopos.use.registers can submit requests to forcibly close sessions or alter cash balances via the API endpoint POST /api/cash-registers/{action}/{register}.
The Ultimate Member WordPress plugin up to version 2.14.0 is vulnerable to stored cross-site scripting (XSS) via the 'user_url' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected profile pages. Exploitation requires a visitor to click the injected Website URL link, which is enabled by default in new installations.
The AI Marketing Expert WordPress plugin (up to version 1.2.8) contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'name' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of administrators accessing the injected pages. Exploitation requires the chatbot module to be active with at least one configured bot. The attack involves storing the payload via unauthenticated REST calls, which is then delivered through the JavaScript widget's auto-polling mechanism.