A misconfiguration in the Nginx routing for Cloud Controller allows unauthenticated access to certain staging callback endpoints under /internal/v3/. This permits attackers with a valid build or droplet GUID to submit forged staging callbacks, transition droplets to a STAGED state, and persist arbitrary metadata without proper authorization. The issue enables privilege escalation beyond intended role boundaries due to insufficient access controls on these endpoints.
A SQL Injection vulnerability exists in Apache Fineract through version 1.15.0. It affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint due to improper neutralization of special elements in SQL commands. This allows attackers to inject malicious SQL code. The issue is fixed in version 1.16.1.
A vulnerability in GCC libstdc++ occurs when extracting data into a bitset from a wide-character stream, causing improper stack memory allocation related to character size and alignment. This flaw can lead to a stack-based buffer overflow, potentially resulting in a denial of service (DoS) if an attacker supplies crafted input. The vulnerability requires specific application behavior and is rated as medium severity with a CVSS score of 6.5. No patch or mitigation is currently available that meets Red Hat's criteria for ease of use and stability.
A vulnerability in gcc's libstdc++ library allows a denial of service (DoS) via the std::from_chars() function when processing a non-null-terminated string. This triggers an out-of-bounds read beyond the allocated buffer, potentially causing application crashes or invalid floating-point conversions. The issue is rated low severity due to the requirement for untrusted, non-null-terminated input and the limited impact confined to crashes or inaccurate parsing without memory corruption or code execution.
The Gravity Forms plugin for WordPress up to version 3.1.1 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. The issue arises because some fields allow raw HTML submissions that bypass sanitization and are later decoded into executable markup by the browser.
A vulnerability in the libstdc++ component of GCC allows an attacker to trigger an integer wrap by providing an excessively large element count to a std::vector<bool> constructor. This leads to an inconsistent container state and out-of-bounds memory access, causing application crashes or Denial of Service (DoS). Exploitation requires attacker-controlled near-maximum integer values during container initialization, limiting the practical exposure. No mitigation is currently available that meets Red Hat's criteria, and the vulnerability is rated moderate severity.
The Gravity Forms plugin for WordPress versions up to and including 3.1.2 contains a stored cross-site scripting (XSS) vulnerability via the List Field. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires an administrator to click a crafted link in the entry detail view and confirm a dialog, triggering execution of attacker-supplied JavaScript code.
The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35. This vulnerability arises from insufficient validation of URL prefixes and improper permission checks that allow authenticated users with subscriber-level access or higher to install plugins without proper capabilities. Exploitation requires the site to be using the free version of the plugin (Formidable Pro is not installed).
A critical vulnerability exists in Teltonika Networks RUTOS devices (versions 7.22 through 7.24.2) and TSWOS devices (versions 1.9 through 1.10) that allows unauthenticated users to directly invoke LUA functions, bypassing normal API validation. This flaw can lead to operating system command execution due to improper request flow handling.
A vulnerability in GCC's libstdc++ parallel search implementation allows a local attacker to cause an out-of-bounds memory access due to an undersized internal buffer. This can lead to a denial of service (DoS) by crashing the affected process. Exploitation requires the application to be compiled with the optional parallel mode, which is not enabled by default.
A vulnerability in the Kroxylicious ACL authorizer's prefix-matching logic can cause authorization rules to be incorrectly applied or bypassed. This flaw may allow an authenticated Kafka client to access resources, such as reading a topic, that should be denied based on the ACL configuration.
The Food Store plugin for WordPress versions up to and including 1.5.5 contains a stored cross-site scripting (XSS) vulnerability via the 'service_time' parameter. This vulnerability arises due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled while 'Enable Pickup/Delivery Service' remains enabled.
A flaw in Red Hat Enterprise Linux 9 kernel builds (RHEL 9.6 through 9.10) involves an incomplete backport of a previous fix, causing a local_bh imbalance in the seg6_input_core() function. This flaw can lead to softirq starvation and denial of service on systems configured with SRv6 tunnels. Upstream Linux kernels and RHEL 10 are not affected.
The Gravity Forms plugin for WordPress up to and including version 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of input type List. This occurs because the plugin uses WordPress' unrestricted maybe_unserialize() instead of its own hardened version, allowing unauthenticated attackers to inject PHP objects into post meta. While the plugin itself lacks a gadget chain, other plugins or themes may provide one, potentially enabling remote code execution. Specifically, if the custom field maps to the protected _wp_page_template meta key, WordPress functions can be leveraged to achieve remote code execution on vulnerable hosts.
The AI Engine WordPress plugin up to version 3.8.6 has a Missing Authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This flaw allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the malicious client on the OAuth consent screen, attackers can gain administrator-level control, including user creation and option updates. The consent page lacks protections against clickjacking, increasing the risk of unauthorized approval.
The log-utils-sdk package version 0.4.1 on PyPI contains malicious code that executes upon import or use. This code downloads additional malicious scripts and runs a background process that periodically connects to a remote host to receive further commands. The package is a clone of a legitimate library and is part of a known malicious campaign involving obfuscation and remote command execution.
Dell has addressed multiple critical vulnerabilities in its PowerProtect Data Domain products, including Data Domain Virtual Edition and Data Domain Management Center. These vulnerabilities span a range of common weakness enumerations (CWEs) such as path traversal, buffer overflow, improper input validation, and authentication issues. No specific affected versions or detailed technical descriptions are provided. No known exploits in the wild have been reported at this time.
CVE-2026-97209 is an insecure temporary file vulnerability in Elixir's Mix deps.partition feature affecting versions from 1.20.0-rc.4 up to but not including 1.20.5. The vulnerability allows a local user on the same host to execute code as another user by exploiting the way partitioned dependency compilation handles configuration files in a shared temporary directory. The issue arises because the directory is created without ownership checks, enabling an attacker to replace the file before it is read by the client process. This flaw has been fixed in version 1.20.5.
CVE-2026-115274 is a vulnerability in the Elixir standard library's JSON module where improper validation of integer literal length in JSON input can lead to denial of service via CPU and memory exhaustion. The functions JSON.decode/1 and JSON.decode!/1 convert integer literals without bounding their length, allowing extremely large integers to consume excessive resources. This affects Elixir versions from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5. Fixed versions are 1.18.6, 1.19.7, and 1.20.5.
CVE-2026-109821 is a vulnerability in the Elixir standard library's URI module where improper validation of the port component in a URL can lead to denial of service via CPU exhaustion. The URI.parse/1 function converts the port string to an integer without limiting its length, allowing extremely large port numbers to be processed. Rendering such a URI back to text triggers a quadratic-time conversion in Erlang/OTP versions 27, 28, and 29.0, causing significant CPU load and delays. This affects Elixir versions from 0.5.0 up to but not including 1.18.6, from 1.19.0-rc.0 up to but not including 1.19.7, and from 1.20.0-rc.0 up to but not including 1.20.5.