A vulnerability in JetBrains Datalore versions before 2026.4 allows improper authorization that enables an attacker to read the notebook owner's file storage session token. This flaw could lead to unauthorized access to sensitive session data.
A code execution vulnerability exists in JetBrains CLion versions before 2026.3 and 2026.2.4.1. This flaw allows code execution in Safe Mode via a crafted GDB server debug profile. The vulnerability is tracked as CVE-2026-123276 and has a high severity rating with a CVSS score of 7.8.
A critical vulnerability in JetBrains Datalore versions before 2026.4 allows view-only collaborators to execute code within a notebook's computation environment. This flaw could lead to complete compromise of confidentiality, integrity, and availability of the affected system.
The Wp Parsidate WordPress plugin versions up to and including 6.4 contain a stored cross-site scripting (XSS) vulnerability in the calendar Gutenberg block's 'theme' attribute. This flaw arises from insufficient sanitization and escaping of user input, allowing authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
An SQL injection vulnerability exists in Atmira’s SIREC where user-supplied JSON input is concatenated into SQL queries without proper sanitization. This flaw allows attackers to alter the intended SQL query, potentially causing the database to return unauthorized or unexpected information. The vulnerability has a high severity rating with a CVSS score of 8.7. No affected versions or patches are specified in the available data.
The WP User Manager plugin for WordPress up to version 2.10.2 contains a stored cross-site scripting (XSS) vulnerability via the 'name' parameter in the REST users endpoint. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because the plugin's front-end sanitization is bypassed by using the WordPress core REST endpoint, making save-time sanitization ineffective.
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress contains a time-based SQL Injection vulnerability in the 'params[searchKey]' parameter. This affects all versions up to and including 2.7.8. The flaw allows authenticated users with administrator-level privileges or higher to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. This can lead to unauthorized extraction of sensitive database information.
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress versions up to and including 1.4.1 contains a stored cross-site scripting (XSS) vulnerability via the 'vars' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that a page or post includes the plugin's [meta_data_filter_results] shortcode, which outputs the vulnerable content.
The VOD Infomaniak plugin for WordPress up to version 1.5.15 has an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access to perform actions reserved for higher roles, such as Contributor and above. Attackers can misuse the site owner's Infomaniak API credentials to import unauthorized videos, consume the VOD account quota, and manipulate video content displayed via public shortcodes.
The Eventin WordPress plugin (up to version 4.1.29) has a vulnerability that allows authenticated users with subscriber-level access or higher to access sensitive information. By manipulating the 'id' parameter in a query string, an attacker can retrieve email addresses and phone numbers of any WordPress user, including administrators.
A vulnerability in Grafana OSS and Grafana Enterprise version 12.4 allows any user, regardless of role or permissions, including Viewers and service accounts with no permissions, to create, externally publish, and delete dashboard snapshots due to missing authorization checks. Earlier versions and Grafana 13 are not affected.
The Redirection for Contact Form 7 WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 3.2.14. This flaw allows unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy server-side files with allowed MIME types into the plugin's uploads directory. Exploitation requires a Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
A memory safety issue exists in OCaml versions before 4.14.5 involving ephemerons whose keys are closures with the Infix_tag. During garbage collection, the ephemeron's data can be freed while still referenced, leading to a use-after-free condition. This flaw was fixed in OCaml 4.14.5.
Security researchers discovered that six IP addresses within the White House network were used as exit nodes by 28 residential proxy services over a month. The proxy activity mainly occurred in the evenings, suggesting a device regularly connected during those hours may be infected with proxy software. The traffic originated from Windows 11 machines running the InfaticaSDK, a proxy service provider. This finding indicates that devices on a sensitive government network may be unknowingly facilitating proxy traffic for external users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.
A high-severity authentication bypass vulnerability (CVE-2026-123158) affects OpenSSH servers on Linux distributions using musl libc without PAM enabled. The flaw allows attackers to log in to certain accounts by supplying any password between 257 and 1024 characters. This impacts accounts with a password field set to "*" (no password) and requires the presence of at least one local account with a SHA-256 or SHA-512 hashed password. The vulnerability is present in Alpine Linux releases 3.16 through 3.24 and edge, among others. OpenSSH 10.6p2 includes patches to fix this issue. Immediate patching or disabling password authentication is recommended to mitigate risk.
A vulnerability in actix-http with the compress-brotli feature enabled allows crafted Brotli-encoded HTTP request bodies to bypass decompression memory limits. This can cause the internal buffer to grow to about 1 GiB before the output size limit is reached, potentially exhausting process or host memory with concurrent requests. The issue affects applications that read request bodies via Bytes, String, Json, or Form, even if extractor size limits are configured. The vulnerability is fixed in actix-http version 3.20.3.
Versions 0.11.1 and earlier of vodozemac have a vulnerability where the Olm root key ratchet does not zeroize HKDF output after use. This results in copies of root and chain keys remaining in freed heap memory. An attacker with memory access could recover these keys, compromising forward secrecy for affected sessions.
A vulnerability in actix-http's encoding::Decoder allows unbounded decompression of compressed input streams, which can lead to excessive memory and CPU consumption. This can cause denial of service when processing untrusted gzip, deflate, Brotli, or Zstandard compressed bodies. The issue affects versions prior to 3.20.1. Fixed in actix-http 3.20.1 and actix-web 4.18.2, where limits on decompression are enforced.