Directus versions before 12.1.0 have an authorization bypass vulnerability. This flaw allows unauthenticated attackers to bypass permission checks on public-mode WebSocket connections by sending a failed authentication message with an invalid token. As a result, attackers can perform read, create, update, or delete operations on any user-defined collection without proper authorization.
LimeSurvey Community Edition 7.8.0 has an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can craft a .lsa archive that leads to execution of attacker-controlled SQL commands when exporting responses from the imported survey. This occurs because attribute names containing parentheses are treated as SQL expressions rather than quoted identifiers.
WWBN AVideo versions up to 29.7.1 have a missing authorization vulnerability in the API::get_api_tags() function within the plugin/API/API.php file. This flaw allows registered users to access restricted video data by querying the tags API. Exploitation enables attackers to subscribe to tags and retrieve filenames, titles, and stored video_password values of unlisted, group-restricted, and password-protected videos, potentially allowing unauthorized viewing.
WWBN AVideo versions 6.5 through 29.7.1 have an email verification bypass vulnerability in the User::verifyCode() function due to PHP loose comparison of the recoverPass token. This flaw allows registered users to reuse the installation-wide salt from their own verification link to craft a code that can verify other users' email addresses, potentially unlocking features like live streaming for those accounts.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the DataTables integration. This flaw allows users with page-edit rights to inject HTML entity-encoded markup into data-search or data-filter cell attributes, which can execute scripts in the browsers of viewers, including administrators.
LibreCAD versions through 2.2.1.6 have a heap-based out-of-bounds write vulnerability in the bundled libdxfrw library's dwgReader18::parseDataPage() function. This flaw arises from unchecked buffer sizes and page offsets when processing AC1018 (R2004) DWG files. Maliciously crafted DWG files with manipulated startOffset values can trigger heap buffer overflows during decompression, potentially causing application crashes and enabling code execution.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the OptionsBuilder::profiles() function. This flaw allows users with the smw-schemaedit permission to inject malicious markup by saving specially crafted FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels. The injected scripts execute for every visitor to the Special:FacetedSearch page, including administrators, potentially compromising their sessions or data.
WWBN AVideo versions up to 29.7.1 have a missing authorization vulnerability in the Live plugin's restream endpoints. This flaw allows authenticated streamers to access other users' stream keys by manipulating live_transmitions_history_id parameters. Exploiting this, attackers can retrieve victims' HLS URLs and stream keys, enabling them to impersonate victims or restream private or pay-per-view live streams.
MQTTX desktop versions up to 1.13.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers who control an MQTT broker or publish to subscribed topics to inject malicious scripts via MQTT topic names or payloads. These scripts execute in the Electron renderer process with nodeIntegration enabled when victims hover over certain UI elements, such as Topic Tree or JSON tree nodes. The vulnerability has a CVSS score of 6.1, indicating medium severity.
WriteFreely versions before 0.17.3 are affected by a stored cross-site scripting (XSS) vulnerability. Authenticated authors can exploit this flaw by injecting malicious HTML through the post slug in the CreatePost API. This injected script executes in RSS/Atom feed readers, newsletter recipients, and ActivityPub viewers, potentially compromising confidentiality and integrity.
Multiple security vulnerabilities have been identified and addressed in the Apache HTTP Server (httpd) 2.4 packages provided by Red Hat. These include heap-based buffer overflows, NULL pointer dereferences, buffer over-reads, and denial of service issues affecting various modules such as mod_proxy_html, mod_xml2enc, mod_headers, and mod_mime. The update also includes an incomplete fix for a previous vulnerability (CVE-2023-38709). Red Hat has released security updates for Red Hat Enterprise Linux 8.8 variants to address these issues.
Red Hat OpenShift Container Platform 4.17.60 includes security updates addressing three vulnerabilities: a denial of service in Go HTTP/2 via malformed SETTINGS_MAX_FRAME_SIZE frames (CVE-2026-33814), an integrity verification bypass in the installer container downloading remote inventory scripts (CVE-2026-92092), and man-in-the-middle attacks via untrusted intermediate certificates in Go's crypto/x509 package (CVE-2026-111943). Users of OpenShift Container Platform 4.17 are advised to upgrade to these updated packages and images when available.
Multiple denial of service vulnerabilities have been identified in Wireshark protocol dissectors, including C12.22, RRC, ESS, H.245, and SPDY. These flaws could cause crashes or heap-based buffer overflows when processing specially crafted network traffic. Red Hat has issued an important security update for Wireshark in Red Hat Enterprise Linux 9 to address these issues.
Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages used in Red Hat Enterprise Linux 8 and related products. The update addresses several use-after-free vulnerabilities, denial of service issues, and other security flaws affecting kernel components such as TCP ULP support, PPP over L2TP, openvswitch, Bluetooth management, network bridging, ALSA MIDI and PCM, s390 boot parameters, and iSCSI management. These vulnerabilities have been assigned CVEs and are rated with an important security impact. The update requires a system reboot to take effect.
A denial of service vulnerability (CVE-2026-82397) exists in the python-tornado package used in Red Hat Enterprise Linux 9.6 Extended Update Support. The flaw allows denial of service via excessive URL-encoded body fields. Red Hat has issued an important security advisory with updated python-tornado packages to address this issue.
A synchronization issue in the Go standard library net/http package affects HTTP/1 servers using MaxBytesReader or MaxBytesHandler. When the MaxBytesReader limit is exceeded, the "Connection: close" header is set automatically without proper synchronization, which can race with other headers set explicitly by the server handler. This race condition can cause the server to crash due to a runtime panic if the handler reads the request body concurrently with writing the response header. Fixed versions 1.26.11 and 1.27.4 address this issue.
CVE-2026-97033 is a command injection vulnerability in the Go toolchain's cmd/go component related to the handling of cgo compiler and linker flags. Malicious packages using cgo could exploit certain flags to execute arbitrary code during build time. The vulnerability arises from unsafe use of flags such as --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x in #cgo directives. The Go project has mitigated this by disallowing or restricting these flags and verifying their usage. Fixed versions are 1.26.11 and 1.27.4.
CVE-2026-97034 is a command injection vulnerability in the Go toolchain's cmd/go component when using GCC and cgo. It arises during the linking phase if malicious GCC spec files are present, potentially allowing arbitrary command execution. The vulnerability involves unsafe evaluation of GCC link specs when certain compiler flags like -fopenmp, -fopenacc, or -fsanitize= are used. The Go toolchain has been updated to reject directories containing GCC spec files and disallow certain flag prefixes to mitigate this risk.
CVE-2026-97035 is an argument injection vulnerability in the Go toolchain's cmd/go component affecting versions before 1.26.11 and between 1.27.0-0 and 1.27.4. It arises when building malicious packages using cgo with Clang or GCC compilers. The vulnerability allows unexpected code execution at build time or writing files to arbitrary directories via certain compiler and linker flags in #cgo directives. The issue stems from improper handling of "-gen-*" and "-gnat*" flags, which were previously allowed and could desynchronize argument parsing, enabling injection of unvalidated inputs to the linker. The flags "-gen-*" and "-gnat*" are now disallowed to mitigate this risk.
A vulnerability in the Go toolchain's cmd/go on Darwin platforms allows argument injection via malicious use of cgo with specific linker flags. This can lead to arbitrary code execution due to how the Apple linker recombines separated '-l' and 'to_library' arguments into a single flag that loads an arbitrary LTO plugin dynamic library at link time. The Go toolchain has been updated to disallow these dangerous linker flags and patterns to prevent exploitation.