A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS).
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
Gravity Forms plugin for WordPress versions up to and including 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of type List. This occurs because the plugin uses WordPress' maybe_unserialize() without restrictions instead of its own hardened deserialization function. An attacker can inject PHP objects into post meta, potentially leading to remote code execution if a suitable gadget chain exists in other plugins, themes, or WordPress itself.
The AI Engine – MCP Server & AI Chatbot for WordPress plugin (versions up to 3.8.6) contains a missing authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This endpoint allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the attacker's client on the OAuth consent screen, the attacker can gain administrator-level access through the MCP tools. The consent page lacks protections against clickjacking, enabling attackers to trick administrators into approving malicious clients.
The Food Store – Online Food Delivery & Pickup WordPress plugin versions up to 1.5.5 are vulnerable to stored cross-site scripting (XSS) via the 'service_time' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled and 'Enable Pickup/Delivery Service' is enabled.
Gravity Forms plugin for WordPress versions up to and including 3.1.2 is vulnerable to stored cross-site scripting (XSS) via the List Field. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the injected entry and confirms a dialog. Exploitation requires user interaction by an administrator clicking a crafted link and confirming a prompt.
Formidable Forms WordPress plugin versions up to 6.35 are vulnerable to arbitrary plugin installation via the 'file_url' parameter due to insufficient URL validation and improper permission checks. Authenticated users with subscriber-level access or higher can exploit this vulnerability if the site uses the free version of the plugin (not Formidable Pro).
Gravity Forms plugin for WordPress versions up to 3.1.1 is vulnerable to stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. The issue arises because certain fields allow raw HTML submissions and an entity-encoded payload bypasses sanitization, later decoded into executable markup by the browser.
A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions before 8.8 contain a vulnerability where a parameter is not properly sanitized and escaped before being used in a SQL statement. This flaw allows users with high privileges, such as administrators, to perform SQL injection attacks.
The Forminator Forms plugin for WordPress versions up to and including 1.55.0.2 contains a vulnerability that allows unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory. This occurs because the plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation, which can be exploited via the previous_draft_id parameter referencing a manipulated draft.
The Content Egg plugin for WordPress up to version 12.0.0 contains an authorization bypass vulnerability. Authenticated users with author-level access or higher can exploit this flaw to create posts attributed to other users, including administrators, by manipulating the preset_id parameter. This allows lower-privileged users to create published posts under an administrator's name if they have the publish_posts capability for the relevant post type.
The Fraud Prevention For WooCommerce and EDD WordPress plugin versions before 2.3.6 lack proper authorization checks when adding customer details to the fraud blacklist. This flaw allows users with the Subscriber role and above to add arbitrary legitimate customers to the fraud blacklist, potentially blocking them from placing orders.
The BuddyForms WordPress plugin versions before 2.10.1 contain a vulnerability where the plugin does not verify that a user editing an existing entry is the original author. This flaw allows users with edit access to a form, including those with low privileges such as Subscriber, to overwrite the title, content, and status of posts or pages authored by other users, including administrators.
The JoomSport plugin for WordPress (up to and including version 5.7.14) contains a SQL Injection vulnerability via the 'pgroup' parameter. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries by exploiting insufficient escaping and preparation of the SQL statement. The vulnerability can be triggered by embedding a malicious 'pgroup' value in the [jsMatchPlayerList] shortcode within a post preview, enabling extraction of sensitive database information.
A vulnerability in The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before version 2.191 allows non-super-admin administrators, including subsite administrators on multisite installations, to access the File System Watcher file viewer without proper restrictions. This exposure enables them to read sensitive tracked files such as the main configuration file, disclosing authentication keys, salts, and database credentials.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions before 8.8 contain a vulnerability where tracking data from public visitor requests is not properly sanitized or escaped. This flaw allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the statistics dashboard.
The Joinchat WordPress plugin versions prior to 6.4.2 contain a vulnerability where the message of its button block is not properly escaped before being output in an HTML attribute on the front end. This flaw allows users with Author role or higher to execute stored cross-site scripting (XSS) attacks against visitors of the post, including administrators.
A vulnerability in The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin versions prior to 2.191 allows bypassing password verification during login when using two-factor authentication. An attacker possessing a valid current authenticator app code can log in as any user, including administrators, without needing the account password.