Threat database

CVE-2026-111418 is a server-side request forgery (SSRF) vulnerability in Foxit's official website HTML-to-PDF conversion service. The vulnerability arises because the service supports ZIP-formatted input, which can bypass restrictions on requests to internal IP addresses. This may allow an attacker to discover internal network resources. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity. No known exploits or patches are currently documented.

The Sequential Order Numbers for WooCommerce plugin for WordPress versions up to and including 3.6.5 is vulnerable to stored cross-site scripting (XSS) via 'condition' post meta array keys. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.

A medium-severity vulnerability (CVE-2026-88941) was identified and fixed in the Network Agent for Windows module of Kaspersky Security Center. The flaw could cause the Network Agent module to malfunction but has no confirmed exploitation in the wild. The vulnerability involves limited privileges and requires local access, with no impact on confidentiality but potential integrity and availability issues.

The RSS Aggregator by Feedzy WordPress plugin (up to version 5.2.12) is vulnerable to stored cross-site scripting (XSS) via the media:group/media:description XML element in imported feeds. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. Exploitation requires an administrator to configure a feed import pointing to a malicious feed URL and trigger the import through the plugin's standard workflow.

The Everest Forms WordPress plugin up to version 3.6.2 contains a reflected cross-site scripting (XSS) vulnerability via the 'evf_toast_type' parameter. This flaw allows unauthenticated attackers to inject arbitrary scripts that execute in a user's browser if the user is tricked into clicking a crafted link. Exploitation depends on the 'evf_toast' parameter decoding successfully via atob(), which is attacker-controlled.

The Extensions for Leaflet Map plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in all versions up to and including 5.4. This vulnerability arises from insufficient input sanitization and output escaping of the 'feature.properties[<template-token>]' parameter. An unauthenticated attacker can inject malicious scripts that execute when users access affected pages. Exploitation requires prior configuration of a public map using specific shortcode combinations pointing to a GeoJSON source controlled by the attacker, which can be achieved through external data host compromise, subdomain takeover, or intentional pointing to attacker-hosted feeds.

The JoomSport plugin for WordPress versions up to and including 5.7.11 contains a SQL Injection vulnerability via the 'team_id' parameter. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries due to insufficient input escaping and query preparation. The vulnerability is triggered when a season lacks an associated joomsport_tournament term, which is the default for new seasons.

A sensitive information exposure vulnerability exists on the Foxit official website due to JavaScript code containing third-party authorization information. This exposure could allow unauthorized parties to obtain or misuse these credentials, potentially leading to significant confidentiality breaches. The vulnerability has a high severity rating with a CVSS score of 8.6.

The Media Library Assistant plugin for WordPress versions up to and including 3.42 is vulnerable to reflected cross-site scripting (XSS) via the 'search-string' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a publicly accessible page with an [mla_gallery] shortcode configured with pagination output mode and an mla_link_href template reflecting a {+request:...+} token, plus enough attachments to trigger pagination. The CVSS score is 4.7, indicating medium severity.

The Mapster WP Maps plugin for WordPress versions up to and including 2.0.5 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the REST route /wp-json/mapster-wp-maps/save-mapmaker lacks proper permission checks, allowing unauthenticated attackers to inject scripts. The plugin's sanitization only removes HTML tags but leaves quote characters intact, and the injected value is concatenated into an inline style attribute without proper escaping. This enables execution of arbitrary scripts when a user views an affected page.

The LiteSpeed Cache plugin for WordPress versions up to and including 7.9.1 contains a stored cross-site scripting (XSS) vulnerability via the 'bbp_reply_content' parameter. This flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that attackers can embed in user-generated content such as bbPress topics. The vulnerability has a CVSS score of 6.4, indicating a medium severity level.

Red Hat has released a security update for its OpenJDK 21 build for Windows (version 21.0.13) addressing multiple security vulnerabilities. This update replaces previous versions 21.0.12 and 21.0.12.1 and includes numerous enhancements and fixes related to cryptographic padding, TLS certificate handling, LDAP logins, HTTP client and server behavior, XML processing, Kerberos validation, image handling, and distrust of certain intermediate CA certificates. The update is rated critical by Red Hat Product Security.

A vulnerability in Python's tarfile module allows crafted tar archives with specially crafted symlink entries to bypass the tar_filter mechanism. This can cause tarfile.extractall() with filter="tar" to write files outside the intended extraction directory, potentially overwriting or creating files elsewhere on the filesystem, depending on the extracting process's permissions. This issue affects multiple Python versions prior to fixed releases and is related to a similar flaw in tarfile.data_filter (CVE-2026-7774).

A use-after-free vulnerability exists in the librsvg2 library when XML includes contain duplicated entities. This security flaw affects the Scalable Vector Graphics (SVG) library based on libart and has been addressed by Red Hat in an update for Red Hat Enterprise Linux 8.4 variants. The vulnerability is tracked as CVE-2026-96889 and has been rated with an important security impact by Red Hat.

MLflow versions from 3.12.0 up to but not including 3.17.0 contain a server-side request forgery (SSRF) vulnerability in the scorer invoke, register, and GenAI evaluate endpoints. This vulnerability allows unauthenticated attackers to send crafted requests that cause the server to make outbound HTTP requests to attacker-controlled or internal hosts. The issue arises from insecure deserialization of third-party scorer data that is resolved using a module-path allowlist but does not restrict constructor arguments. The vulnerability is fixed in version 3.17.0.

Red Hat has released a security advisory for the Linux kernel packages addressing multiple vulnerabilities including an out-of-bounds read in the Wacom HID driver, a Bluetooth protocol error handling flaw, and validation issues in SCTP protocol processing. These vulnerabilities are rated as moderate in severity. The update is available for Red Hat Enterprise Linux 10.0 Extended Update Support and related products. A system reboot is required after applying the update to ensure the fixes take effect.

A security vulnerability in the sudo utility allows bypass of time-based authorization controls via the TZ environment variable. This flaw affects Red Hat Enterprise Linux 8.6 variants and permits users to circumvent NOTBEFORE/NOTAFTER restrictions that control when sudo commands can be executed.

The juniper_warp crate versions prior to 0.9.1 contain a vulnerability in the make_graphql_filter() and make_graphql_filter_sync() filters, which read the entire POST request body into memory without size limits. This allows an unauthenticated client to send a large request body and exhaust server memory, causing a denial of service. Version 0.9.1 and later implement a default 2 MiB limit on request body size and respond with 413 Payload Too Large for larger bodies, mitigating the issue.