BastilleBSD bastille versions up to 1.4.4 have a symlink following vulnerability in certain subcommands that allows jailed users to escape jail isolation. This occurs because jailed users can create symbolic links pointing to host system paths or other jail roots, causing administrator-run copy commands to overwrite or read host files with root privileges.
xiaozhi-esp32-server versions up to 0.9.8 have an authentication bypass vulnerability in the WebSocketServer._handle_auth function. This flaw allows remote attackers to bypass Bearer HMAC token verification by spoofing the Device-ID header with an allowlisted MAC-address-shaped identifier. Exploiting this, attackers can open authenticated WebSocket sessions, issue voice-assistant commands, exchange audio, and access the conversation context of the spoofed device.
WPGraphQL versions before 2.24.1 have a missing authorization vulnerability in the createComment mutation. This flaw allows unauthenticated attackers to add comments to non-public posts, including drafts, private, trashed, or password-protected posts. Exploitation can lead to leaking hidden post titles via moderator notifications, enumerating post IDs, and manipulating comment metadata such as backdating or marking comments as pingbacks.
WPGraphQL versions before 2.24.1 have a vulnerability that allows unauthenticated attackers to bypass rate limiting on the sendPasswordResetEmail mutation by using multiple aliases in a single request. This can flood password reset emails, exhaust mail provider quotas, and prevent legitimate users from recovering their passwords.
WPGraphQL versions before 2.24.2 have an information disclosure vulnerability that allows unauthenticated attackers to infer the existence of certain objects by observing distinct error responses. This flaw affects mutations such as deleteMediaItem, updateMediaItem, deleteComment, and updateComment, enabling attackers to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
WPGraphQL Smart Cache versions before 2.3.3 have a vulnerability that allows unauthenticated attackers to cause uncontrolled resource consumption. This occurs via the Automatic Persisted Query handler, enabling attackers to persist unlimited query documents. By sending distinct queries with matching SHA-256 queryId values, including batched operations, attackers can cause unbounded growth of the wp_posts database table, leading to degraded database performance.
CVE-2026-104067 is an out-of-bounds memory access vulnerability in Scribus versions before 1.6.7. It occurs in the importsvm plugin when it fails to verify that bitmap and transparency mask dimensions match. An attacker can craft a malicious SVM file with mismatched mask dimensions to trigger heap reads and writes, potentially causing application crashes or arbitrary code execution under the user's privileges.
CVE-2026-104066 is a heap buffer overflow vulnerability in Scribus versions before 1.6.7. It occurs in the Mac PICT image loader and import plugin when processing crafted 4-bit indexed pixel data with inconsistent width and row data. Exploitation can cause application crashes or potentially allow code execution.
Scribus versions before 1.6.7 have an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin. This flaw arises from using an unvalidated y offset to select image scanlines when importing crafted DRW files. Exploitation can lead to heap corruption, causing application crashes or potential code execution.
Scribus versions before 1.6.7 have an integer overflow vulnerability in the TIFF loader component. This flaw allows attackers to craft TIFF files with large tile dimensions that trigger a heap overflow when imported, potentially leading to application crashes or arbitrary code execution.
CVE-2026-104063 is an out-of-bounds read vulnerability in Scribus versions before 1.6.7. It affects the Mac PICT image loader and import plugin when decoding planar pixel data. A crafted PICT file with manipulated dimensions can cause heap over-reads, potentially leading to application crashes or disclosure of heap memory.
CVE-2026-104062 is a heap buffer overflow vulnerability in Scribus versions before 1.6.7. It occurs in the PICT image loader and import plugin when processing a crafted PICT file with an unchecked bytesPerLine value exceeding the QImage scanline size. This can cause Scribus to crash and potentially allow code execution with the user's privileges.
CVE-2026-104061 is a heap out-of-bounds write vulnerability in Scribus versions before 1.6.7. It occurs in the scimgdataloader_psd loader due to unchecked PSD file values used as array indexes. An attacker can exploit this by convincing a user to open or import a crafted PSD file, leading to heap corruption, application crashes, and potentially arbitrary code execution with user privileges.
CVE-2026-119369 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It affects versions from initial releases up to 6.18.2. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 6.18.3.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
CVE-2026-116407 is a missing authorization vulnerability in Webba Plugins Webba Booking up to version 6.5.4. It allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure or modification. The issue is fixed in version 6.5.5.
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.