Threat database

Multiple security vulnerabilities have been identified and fixed in the curl packages provided by Red Hat Enterprise Linux 8. These include security feature bypasses, unauthorized connection reuse, cookie injection, and information disclosure issues related to mTLS connection reuse, logical errors, malicious HTTP servers, Digest authentication header reuse, and proxy authentication state. The update also includes bug fixes and enhancements such as increasing the default number of HTTP/2 streams. The vulnerabilities are rated as important by Red Hat Product Security.

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

Multiple Pages Generator by Themeisle versions prior to 4.2.5 contain a stored cross-site scripting (XSS) vulnerability. Contributor-level users can inject malicious scripts via the [mpg] and [mpg_match] shortcode base-url attribute. The vulnerability arises because entity-encoded payloads bypass input filtering but are later decoded and rendered unescaped, allowing script execution in administrator browsers.

lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with a length above std::vector::max_size(), triggering an uncaught std::length_error that aborts the process and denies service to all clients.

flat versions up to and including 6.0.1 have a resource allocation vulnerability in the unflatten() function. This flaw allows attackers to create very large sparse arrays by using unbounded numeric keys, such as a.4294967294. Exploiting this can cause operations like forEach, spread, or JSON.stringify to block the Node.js event loop, leading to denial of service.

Agno versions up to 3.1.11 contain an unsafe reflection vulnerability in the PandasTools component. This flaw allows attackers to supply model-controlled function names to Python's getattr(), enabling invocation of arbitrary pandas functions. Exploitation can involve prompt injection to execute code by calling pandas.read_pickle on attacker-controlled paths or reading local files via other pandas readers.

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.

CVE-2026-42707 is a missing authorization vulnerability in the HivePress Claim Listings plugin versions before 1.1.5. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The issue was fixed in version 1.1.5.

This analysis discusses the challenges and security principles for protecting AI systems, particularly AI agents that autonomously perform tasks with access to critical tools. It highlights the need to treat language models as untrusted, consider all external data potentially malicious, and require human approval for irreversible actions. The approach adapts Security by Design and Cyber Immunity principles, emphasizing minimal attack surfaces, least privilege, component isolation, default deny policies, and defense in depth. The analysis also addresses risks from supply chain components and cloud model updates, as well as practical pitfalls like user fatigue and evolving vulnerabilities in AI frameworks.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.