Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0.
Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0.
A denial of service vulnerability exists in the zip crate versions 5.1.0 up to but not including 9.0.0 when the legacy-zip feature is enabled. An attacker can craft a malicious ZIP64 archive with an uncompressed size set to an extremely large value, causing a capacity overflow panic in the Shrink decoder during extraction. This panic terminates the affected process, leading to denial of service. The issue arises because the decoder reserves output buffer capacity based on the uncompressed size from ZIP metadata before validating the compressed data size. This vulnerability is fixed in version 9.0.0.
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled.
CVE-2026-115794 is a low-severity vulnerability in RT-Labs P-Net versions before 1.0.3. It involves improper handling of a length parameter in the application alarm callback, where the data length derived from a received alarm frame is not validated against the actual frame length. This can cause the callback to receive an excessively large length value, potentially leading to out-of-bounds reads if the application copies that many bytes. Exploitation requires an established Application Relationship and adjacent network access. Applications that do not use the alarm data are not affected. The issue is fixed in version 1.0.3.
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts.
Multiple denial of service vulnerabilities exist in HDF5 before version 2.3.0, including untrusted pointer dereference, NULL pointer dereference, out-of-bounds heap read, and size underflow issues. These flaws affect various components such as the h5dump tool, fill value handling, N-Bit filter processing, and Fletcher32 checksum calculation. The vulnerabilities can be triggered by crafted HDF5 files and may cause application crashes or memory disclosure in constrained cases. A security update fixing these issues is available in version 1.14.5-8.oe2403sp4.
A vulnerability in virtualenv versions 21.14.9 through 21.14.12 allows an attacker-controlled --prompt value to be copied into the PS1 environment variable without proper escaping when promptvars and POSIX mode are disabled. This can lead to command execution when prompt expansion occurs. The issue is fixed in version 21.14.13.
virtualenv versions prior to 21.14.9 allow caller-supplied prompt text to be interpreted as executable syntax in the bash activation prompt. This occurs when an attacker can influence the prompt value and a user activates the environment, causing potential execution of unintended commands. The issue is fixed in version 21.14.9.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability where an unvalidated runtime configuration value allows a CouchDB server administrator to execute arbitrary shell commands as the operating system user running CouchDB. This issue is fixed in version 3.5.3.
A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid="manage"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control.