CVE-2026-65022 is a cross-site scripting (XSS) vulnerability in the MDM App Catalog / App Store preview. The issue arises because user-supplied HTML is not properly sanitized or encoded before rendering, allowing injected HTML to be displayed to users. This can lead to XSS attacks when users interact with the crafted content. The vulnerability has a CVSS score of 6.3, indicating a medium severity level.
A Stored Cross-site Scripting (XSS) vulnerability exists in the Pie Register plugin up to version 3.8.4.15. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in the context of other users. The vulnerability has a high severity with a CVSS score of 7.1.
A vulnerability in Keycloak's administrative services allows a highly privileged attacker with the 'manage-clients' role to escalate privileges to 'realm-admin' by manipulating client configurations such as JSON Web Key Sets, authenticator types, and secrets. This flaw enables unauthorized access to sensitive resources within the Keycloak realm. The issue has a medium severity rating with a CVSS score of 6.5. Currently, no effective mitigation or patch meeting Red Hat's criteria is available.
A vulnerability in GStreamer's gst-plugins-good (avidemux) subindex parser allows excessive memory allocation due to missing validation of the entry count. This can cause a denial of service (DoS) when opening or previewing a crafted AVI file. The issue is fixed in gst-plugins-good version 1.28.6.
The WP Libre Form WordPress plugin version 1.5.0.1 contains a vulnerability where it does not validate the type of files uploaded through its form submissions. This flaw allows unauthenticated attackers to upload PHP files to locations accessible via the web and execute them, resulting in remote code execution.
A vulnerability in BAKKBONE Australia FloristPress (up to version 7.8.4) allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This issue is identified as CWE-201 and has a CVSS 3.1 score of 7.5, indicating high severity. The vulnerability does not require privileges or user interaction and affects confidentiality but not integrity or availability.
A stored cross-site scripting (XSS) vulnerability exists in the Redux Framework up to version 4.5.16. This vulnerability involves improper neutralization of input during web page generation, which can lead to script injection. The flaw allows an attacker with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
The MC4WP: Mailchimp for WordPress plugin versions before 4.15.0 have a vulnerability where request-derived values in dynamic content tags are processed as shortcodes when a form is embedded using its block. This allows unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes, but only if the site owner has added a request-derived tag to the form content and uses the block embedding method instead of the classic shortcode.
A vulnerability was found in the distributed-workloads repository's pull_request_target workflow. This flaw allows a remote attacker to submit a specially crafted pull request that executes untrusted code with access to sensitive repository secrets, including the SNYK_TOKEN and the repository's default write token. Exploitation could lead to exfiltration of these secrets, unauthorized access to the Snyk integration, and potential control over the repository. The issue has been remediated by deleting the vulnerable workflow and removing the exposed secret.
A vulnerability in the training-operator component of Red Hat OpenShift AI allows authenticated users to bypass an immutability check on PyTorchJob resources. This flaw arises from incorrect object casting in the PyTorchJob ValidateUpdate webhook, enabling alteration of the spec.runPolicy.managedBy field after job creation. Exploitation could disrupt resource quota management or hijack job controller ownership, primarily causing a denial of service (DoS) condition. Currently, no effective mitigation or fix meeting Red Hat's criteria is available.
A vulnerability in GStreamer gst-plugins-good (avidemux) allows integer overflow in the superindex and subindex parsers, leading to out-of-bounds reads. This flaw can be triggered by opening or previewing a crafted AVI file because avidemux is auto-plugged by common GStreamer components. The issue can cause application crashes or limited memory disclosure but does not enable arbitrary code execution or privilege escalation under default settings. The vulnerability is fixed in gst-plugins-good version 1.28.6.
A flaw in D-Bus allows an unprivileged local user to cause the dbus-daemon to abort (denial of service) when a privileged monitoring client is attached and a driver-originated broadcast message cannot be delivered. This occurs because driver broadcasts use serial 0, and when delivery fails, an assertion triggers aborting the daemon. This issue is a residual problem from an incomplete fix for CVE-2023-34969 and affects the well-known system bus.
A vulnerability in GStreamer's gst-plugins-good (avidemux) component allows out-of-bounds reads due to improper bounds checking in the Nikon metadata tag parser. This flaw can be triggered by opening or previewing a crafted AVI file, potentially causing application crashes or limited information disclosure. The issue is fixed in gst-plugins-good version 1.28.6.
CVE-2026-123087 is a high-severity SQL injection vulnerability in Atmira's SIREC product. The vulnerability arises because the server retrieves a field value from a user-supplied JSON object and concatenates it directly into an SQL query without proper sanitization. This flaw allows attackers to alter the original SQL query, potentially causing the database to return unauthorized or unexpected information. A fix for this vulnerability was released on October 16, 2026.
CVE-2026-103682 is a vulnerability in Checkmk versions 2.5.0 up to but not including 2.5.0p16 where the Jolokia special agent is invoked with the login password visible in the command line. This allows a local user on the Checkmk server to read the Jolokia login password from the process list while the agent is running. The issue affects both explicitly configured passwords and those retrieved from the password store. The vulnerability has a low severity score and was fixed in version 2.5.0p16.
CVE-2026-103674 is a vulnerability in Checkmk versions 2.5.0 up to but not including 2.5.0p16. It involves the invocation of the NetApp ONTAP special agent with the login password visible in the command line, allowing a local user on the Checkmk server to read the NetApp login password from the process list while the agent runs. Both explicitly configured passwords and those from the password store are affected. The issue is fixed in version 2.5.0p16.
CVE-2026-123660 affects vulnerability-lookup versions 5.5.1 up to but not including 6.4.1. A signed-in user can craft webhook notification payload templates that cause excessive memory allocation during string formatting, leading to potential denial of service. The vulnerability arises because format specifiers in placeholders are passed unchecked to Python's string formatting, allowing very large memory allocations. Version 6.4.1 fixes this by capping format specifier numbers, limiting rendered template size, and restricting template nesting depth.
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An Author-level attacker can submit a percent-encoded HTML/JavaScript payload as a post slug via the REST API, which survives sanitization intact and executes in an administrator's browser session when the URI Editor admin page is loaded.
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view stored WooCommerce payment gateway credentials — including PayPal API username, password, and signature, as well as Stripe test and live secret keys — injected verbatim into the HTML response of the tour edit screen. The credentials are present in the raw HTTP response regardless of the modal's CSS visibility state, making them trivially accessible by viewing page source.