A vulnerability in gcc's libstdc++ library allows a denial of service (DoS) via the std::from_chars() function when processing a non-null-terminated string. This triggers an out-of-bounds read beyond the allocated buffer, potentially causing application crashes or invalid floating-point conversions. The issue is rated low severity due to the requirement for untrusted, non-null-terminated input and the limited impact confined to crashes or inaccurate parsing without memory corruption or code execution.
The Gravity Forms plugin for WordPress up to version 3.1.1 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. The issue arises because some fields allow raw HTML submissions that bypass sanitization and are later decoded into executable markup by the browser.
A vulnerability in the libstdc++ component of GCC allows an attacker to trigger an integer wrap by providing an excessively large element count to a std::vector<bool> constructor. This leads to an inconsistent container state and out-of-bounds memory access, causing application crashes or Denial of Service (DoS). Exploitation requires attacker-controlled near-maximum integer values during container initialization, limiting the practical exposure. No mitigation is currently available that meets Red Hat's criteria, and the vulnerability is rated moderate severity.
The Gravity Forms plugin for WordPress versions up to and including 3.1.2 contains a stored cross-site scripting (XSS) vulnerability via the List Field. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires an administrator to click a crafted link in the entry detail view and confirm a dialog, triggering execution of attacker-supplied JavaScript code.
The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35. This vulnerability arises from insufficient validation of URL prefixes and improper permission checks that allow authenticated users with subscriber-level access or higher to install plugins without proper capabilities. Exploitation requires the site to be using the free version of the plugin (Formidable Pro is not installed).
A critical vulnerability exists in Teltonika Networks RUTOS devices (versions 7.22 through 7.24.2) and TSWOS devices (versions 1.9 through 1.10) that allows unauthenticated users to directly invoke LUA functions, bypassing normal API validation. This flaw can lead to operating system command execution due to improper request flow handling.
A vulnerability in GCC's libstdc++ parallel search implementation allows a local attacker to cause an out-of-bounds memory access due to an undersized internal buffer. This can lead to a denial of service (DoS) by crashing the affected process. Exploitation requires the application to be compiled with the optional parallel mode, which is not enabled by default.
A vulnerability in the Kroxylicious ACL authorizer's prefix-matching logic can cause authorization rules to be incorrectly applied or bypassed. This flaw may allow an authenticated Kafka client to access resources, such as reading a topic, that should be denied based on the ACL configuration.
The Food Store plugin for WordPress versions up to and including 1.5.5 contains a stored cross-site scripting (XSS) vulnerability via the 'service_time' parameter. This vulnerability arises due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled while 'Enable Pickup/Delivery Service' remains enabled.
A flaw in Red Hat Enterprise Linux 9 kernel builds (RHEL 9.6 through 9.10) involves an incomplete backport of a previous fix, causing a local_bh imbalance in the seg6_input_core() function. This flaw can lead to softirq starvation and denial of service on systems configured with SRv6 tunnels. Upstream Linux kernels and RHEL 10 are not affected.
The Gravity Forms plugin for WordPress up to and including version 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of input type List. This occurs because the plugin uses WordPress' unrestricted maybe_unserialize() instead of its own hardened version, allowing unauthenticated attackers to inject PHP objects into post meta. While the plugin itself lacks a gadget chain, other plugins or themes may provide one, potentially enabling remote code execution. Specifically, if the custom field maps to the protected _wp_page_template meta key, WordPress functions can be leveraged to achieve remote code execution on vulnerable hosts.
The AI Engine WordPress plugin up to version 3.8.6 has a Missing Authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This flaw allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the malicious client on the OAuth consent screen, attackers can gain administrator-level control, including user creation and option updates. The consent page lacks protections against clickjacking, increasing the risk of unauthorized approval.
The log-utils-sdk package version 0.4.1 on PyPI contains malicious code that executes upon import or use. This code downloads additional malicious scripts and runs a background process that periodically connects to a remote host to receive further commands. The package is a clone of a legitimate library and is part of a known malicious campaign involving obfuscation and remote command execution.
Dell has addressed multiple critical vulnerabilities in its PowerProtect Data Domain products, including Data Domain Virtual Edition and Data Domain Management Center. These vulnerabilities span a range of common weakness enumerations (CWEs) such as path traversal, buffer overflow, improper input validation, and authentication issues. No specific affected versions or detailed technical descriptions are provided. No known exploits in the wild have been reported at this time.
Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.
Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.
This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.
JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.
URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.
This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.
An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
CVE-2026-111585 is a high-severity integer overflow vulnerability in TeamViewer's remote-control screen processing component affecting Windows, macOS, Linux, and Android clients. It allows a malicious or compromised host to send crafted screen dimension data that causes a buffer overflow in the viewer application, potentially leading to denial-of-service or arbitrary code execution on the viewer's system. Exploitation requires the viewer to establish a remote session with the attacker-controlled host. TeamViewer has released patches in version 15.83 and for multiple legacy versions to address this and related vulnerabilities.
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.