CVE-2026-120218 is a cross-site scripting (XSS) vulnerability in Typemill up to version 2.26.0. The flaw exists in the ControllerApiImage::saveImage function within SvgSanitizer.php. This vulnerability can be exploited remotely and allows attackers to execute malicious scripts. An exploit has been published publicly. Upgrading to Typemill version 2.27.0 resolves the issue.
CVE-2026-120217 is a medium-severity vulnerability in Delgan loguru version 0.7.3. It involves inefficient regular expression complexity in the AnsiParser.feed function of the ANSI Color-Markup Parser component. This flaw can be exploited remotely and public exploit code is available. The vendor has not responded to the disclosure and no patch information is provided.
A vulnerability in the MapPress WordPress plugin before version 2.97.15 allows unauthenticated visitors to access sensitive user information. Specifically, the plugin's front-end map embed handler does not restrict which user's data it renders, enabling enumeration of user IDs to retrieve email addresses and display names of any user on the site.
A stored cross-site scripting (XSS) vulnerability exists in the Media Library Assistant WordPress plugin before version 3.44. The flaw arises because one of the plugin's shortcode attributes is not properly escaped before being output in an attribute of generated links. This allows users with Contributor role or higher to inject malicious scripts that persist and execute in other users' browsers.
A missing authorization vulnerability in the Media Library Assistant WordPress plugin before version 3.44 allows any authenticated user, including subscribers, to view taxonomy term assignments of private attachments and posts. This could lead to unauthorized disclosure of metadata related to private content.
Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions before 2.4.30 contain a missing authorization vulnerability in the test-email handler. The plugin relies solely on a nonce accessible to any logged-in user without verifying user capabilities, allowing low-privileged users such as Subscribers to send emails to arbitrary recipients with spoofed sender addresses.
Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions before 2.4.30 contain a vulnerability that allows authenticated users with minimal privileges to disclose the email addresses of any registered user, including administrators. This occurs because the plugin's test-email handler does not perform proper capability checks and relies solely on a nonce accessible to all logged-in users.
CVE-2026-120198 is a critical command injection vulnerability in the WAVLINK WL-WN530BE1-A device, specifically in the con_check_read_finish function of the /protocol.csp file. The vulnerability arises from improper handling of the argument group_name/IP-FROM, allowing remote attackers to execute arbitrary commands. The exploit has been publicly disclosed and may be used. No specific affected versions or patches are provided in the available data.
CVE-2026-120197 is a critical OS command injection vulnerability in the WAVLINK WL-WN530HG4B router, specifically in the port_forward function of /cgi-bin/wapi.cgi. The flaw allows remote attackers to manipulate the 'Name' argument to execute arbitrary OS commands. Exploit code has been published, increasing the risk of exploitation. No affected versions or patches are specified in the available data.
A security vulnerability in Presenton up to version 0.9.11-beta allows remote attackers to cause information disclosure by manipulating an unspecified part of the /app_data file in the Desktop Authentication Middleware component. The vulnerability has a medium severity with a CVSS score of 5.3. Public exploit code has been disclosed. Upgrading to version 0.9.12-beta mitigates the issue.
OpenAlgo versions from 1.0.0.29 up to but not including 2.0.3.1 contain an improper certificate validation vulnerability in the email utility modules. This flaw disables TLS hostname and certificate checks for STARTTLS and SMTPS connections, allowing network attackers to present forged certificates. Successful exploitation can lead to interception of SMTP credentials and subsequent email traffic, including sensitive information such as password-reset links.
An infinite loop vulnerability exists in imagecodecs versions 2026.3.6 through 2026.10.10 within the ccitt_fax4_decode_size() function. This flaw allows attackers to cause a denial-of-service by supplying a crafted CCITT Group 4 stream that lacks an End Of Facsimile Block (EOFB), leading to full CPU consumption until the affected process is terminated.
Thelia Back-office Default Twig Template versions before 1.1.1 have a cross-site request forgery (CSRF) vulnerability affecting specific admin routes that accept GET requests without anti-CSRF token validation. This flaw allows an attacker to trick a logged-in administrator into executing unauthorized actions that modify product combination details such as prices, stock, weight, EAN, and sale flags, potentially zeroing omitted prices.
A stack-based buffer overflow vulnerability exists in imagecodecs versions 2023.1.23 through 2026.10.10 in the lossless JPEG Define Huffman Table parser. This flaw occurs when a crafted lossless JPEG file causes the DHT symbol counts to wrap an 8-bit sum, overflowing internal stack arrays and crashing the process.
Thelia versions before 3.1.1 have a stored cross-site scripting (XSS) vulnerability that allows authenticated back-office administrators with store update permissions to inject malicious scripts by uploading unsanitized SVG images as logo or banner files. This vulnerability enables attackers to execute scripts in the context of visitors and higher-privileged administrators via payloads served from specific directories.
FFmpeg versions 2.3 through 9.0.2 have a use of uninitialized resource vulnerability in the Huffyuv decoder. This flaw allows attackers to leak heap memory into decoded pixels by crafting specially malformed Huffyuv BGR24/BGRA video bitstreams with early-ending entropy data. The vulnerability results in uninitialized memory bytes being included in output frames, exposing potentially sensitive heap contents.
A weakness in Presenton up to version 0.9.11-beta allows remote attackers to bypass authentication due to an issue in the API component. This vulnerability can be exploited without user interaction and has a high severity rating. Public exploit code is available. Upgrading to version 0.9.12-beta resolves the issue.
FFmpeg versions 2.0 through 9.0.2 have a vulnerability in the Go2Meeting decoder where an uninitialized variable is used. This flaw allows attackers to leak stack memory by crafting a malicious G2M3/G2M4 stream with a short Kempf palette, causing uninitialized stack bytes to be copied into the decoded output.
A cross-site scripting (XSS) vulnerability exists in PostyBirb Plus versions up to 3.1.75 in the Submission Description Editor component. This flaw allows remote attackers to inject malicious scripts via the DescriptionInput.tsx file. The vulnerability is addressed in version 3.1.76, which users are advised to upgrade to.
FFmpeg versions 0.10 through 9.0.2 have a vulnerability in the sunrast_decode_frame() function that causes heap memory leakage when decoding truncated 1-bit and 4-bit paletted Sun Raster images. This occurs due to use of uninitialized resources, which can expose stale heap contents in the decoded output.