A security vulnerability identified as CVE-2026-116540 affects the wso2mi package due to an issue in netty-tcnative 2. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. It impacts availability but does not affect confidentiality or integrity. Fixed versions are available starting from 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0.
CVE-2026-71497 is a medium severity security vulnerability affecting the wso2mi package, which uses the jsoup Java library for processing HTML. The vulnerability impacts versions prior to 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0. It has a CVSS score of 4.7 with network attack vector, high attack complexity, no privileges required, and requires user interaction. The vulnerability results in limited confidentiality and integrity impact but no availability impact. Fixed versions are available.
A high-severity security vulnerability (CVE-2026-75140) affects the wso2mi package due to an issue involving jsoup. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are available.
A critical security vulnerability (CVE-2025-59340) affects the wso2mi package due to an issue in jinjava, a Java-based template engine adapted from Django template syntax to render Jinja templates. The vulnerability has a CVSS score of 10.0, indicating it is exploitable remotely without authentication and can lead to complete confidentiality, integrity, and availability compromise. Fixed versions 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are available.
A security vulnerability exists in the Trino package due to differences in the Jetty URI parser's handling of invalid or unusual URIs compared to other common parsers. This flaw affects versions prior to 484-r0 and may lead to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and a CVSS score of 6.5.
A security vulnerability in the Trino package affects Eclipse Jetty's handling of HTTP/1, HTTP/2, and HTTP/3 requests. The flaw is due to the lack of strict verification that the request authority (host and port) matches the Host header if present. This vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 484-r0.
CVE-2024-6763 is a medium severity vulnerability affecting the Trino package, specifically related to the Eclipse Jetty web server component. The flaw does not impact confidentiality or availability but allows for integrity compromise without requiring privileges or user interaction. A fix is available in version 484-r0.
A critical security vulnerability exists in the Trino package due to the Eclipse Jetty Digest authentication server-side component using ISO-8859-1 encoding for passwords. This flaw affects versions of Trino prior to 484-r0 and can lead to high confidentiality and availability impacts. A fix is available in version 484-r0.
A high-severity security vulnerability exists in the Trino package due to an issue in Eclipse Jetty's JASPIAuthenticator class, which sets two ThreadLocal variables during authentication checks. This flaw affects versions of Trino prior to 484-r0 and could lead to high-impact confidentiality and integrity breaches. A fix is available in version 484-r0.
Multiple injection vulnerabilities exist in resource metadata fields of GBIF Integrated Publishing Toolkit versions before 3.3.5. These flaws allow authenticated remote attackers to execute code in another user's session via stored cross-site scripting after user interaction. The vulnerabilities have a medium severity rating and a CVSS score of 4.8. No patch or fixed version information is provided in the available data.
A Cross-Site Scripting (XSS) vulnerability exists in myCred up to version 4.0.2 due to improper neutralization of script-related HTML tags, allowing code injection. This vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation details are provided in the available data.
A missing authorization vulnerability exists in ibericode MC4WP (mailchimp-for-wp) versions up to 4.14.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized modification of data or settings. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability in OpenShift Pipelines-as-Code (PAC) allows a namespace user with limited permissions to escalate privileges within that namespace. The flaw arises because PAC does not verify if the creator of a Repository custom resource is authorized to create PipelineRuns. This enables execution of attacker-controlled PipelineRuns with the pipeline ServiceAccount, which by default has ClusterRole/edit permissions. The result is namespace-scoped privilege escalation, allowing unauthorized reading of Secrets, resource manipulation, and potential supply chain injection in CI/CD namespaces.
A missing authorization vulnerability exists in WProyal Royal Elementor Addons (royal-elementor-addons) affecting versions up to 1.7.1068. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact primarily on confidentiality. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.
A vulnerability in OpenBMB Internet of Agents affects the _primary_field_query function in the Agent Registry component. The flaw involves improper neutralization of special elements in data query logic due to manipulation of the argument key. This vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so no specific affected or fixed versions are identified. The project has been notified but has not yet responded or issued a fix. The CVSS score is 7.3, indicating high severity.
A missing authorization vulnerability exists in WP SYNTEX Polylang plugin versions up to 3.9. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability has a medium severity rating with a CVSS score of 5.4.
A vulnerability in the NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples allows improper handling of non-secure-world input. This flaw affects versions through 26.06.00-lts and 26.09.00-pvw2 and may enable a non-secure caller to supply unvalidated pointers or untrusted data. The issue can lead to timing side-channel attacks, TOCTOU conditions, or format-string misuse, potentially causing secure-world memory disclosure or denial of service. Versions starting from 26.06.01-lts and 26.09.00 have addressed this vulnerability.
A stored cross-site scripting (XSS) vulnerability exists in WPMU DEV Smush Image Compression and Optimization plugin versions up to 4.3.5. This vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of the affected application. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
UgCS server versions before 6.2 have an authentication bypass vulnerability in the HCI protocol login handler on TCP port 3334. If the user database contains exactly one user, a login request with empty credentials is accepted as that user, granting a fully authenticated session. The service listens on all interfaces without TLS by default, allowing unauthenticated remote attackers with network access to port 3334 to gain privileged access, including commanding drones and uploading flight routes.
A vulnerability in the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_examples/rpmsg_lite_pingpong_tzm) up to versions 26.06.00-lts and 26.09.00 allows improper input validation in non-secure-callable veneer functions. This flaw permits a non-secure caller to supply unvalidated pointers and size values, which may lead to disclosure of secure-world memory or denial of service. The issue is fixed in versions starting from 26.06.01-lts and 26.12.00-pvw1.