CVE-2026-62162 is a missing authorization vulnerability in the Cardano layer-two scaling solution Hydra prior to version 2.1.0. The flaw allows third parties to consume pending deposit UTxOs before the deposit deadline without proper authorization, redirecting assets to arbitrary addresses. This occurs because the validator does not require spending the Head state-token UTxO or constrain outputs, enabling bypass of safety checks. The issue is fixed in Hydra version 2.1.0.
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.
VoiceSentinel versions from 2.2.1 up to but not including 3.3.1 have a race condition in the optional report buffer feature. This race occurs between retention cleanup and transcript writes, leading to possible loss, duplication, or corruption of transcript data. The issue can also cause unbounded disk growth, potentially exhausting storage and crashing the host or other services. The feature is disabled by default and must be enabled to be affected. The vulnerability is fixed in version 3.3.1.
CVE-2026-61840 is a server-side request forgery (SSRF) vulnerability in the open-source Discord bot Quest Bot prior to version 1.1.9. The flaw arises from the 'image to GIF' command, which performs hostname validation against public IP addresses but then makes requests by hostname, allowing a second DNS lookup. This enables DNS rebinding attacks where an attacker-controlled domain can bypass internal address protections. The vulnerability allows any server member to trigger the flaw without special permissions. Requests are limited to HTTPS on port 443 and only return genuine image content, limiting impact to blind internal probing and limited image retrieval from internal endpoints. The issue is fixed in version 1.1.9.
CVE-2026-119117 is a vulnerability in the Amazon Kinesis Producer Library for Java versions before 1.0.8 and up to 0.15.12, where sensitive AWS credentials may be exposed. When the library's logger is set to DEBUG level, these credentials can be written into log files. Additionally, the credentials are passed as command-line arguments to native child processes, making them accessible to local users via the process argument list.
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.
CVE-2026-39739 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite, specifically in the header-footer-elementor component. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability affects versions from initial release up to 2.9.5 and has been fixed in version 2.9.6.
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot.
When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so that table was never included in the authorization check. An authenticated user who is authorized for at least one table can therefore read columns from any dimension table in the cluster, including tables they have no access to, and can retrieve arbitrary rows of it by supplying primary key values directly. Per-principal row-level security filters configured on the dimension table are likewise not applied.
The multi-stage query engine is not affected.
This issue affects Apache Pinot: through 1.5.1
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
The npm package vas-tops2-reportingui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package vas-tops2-core-clients-search contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package '@sxm-content-creators/tools-ds' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not eliminate all malicious software introduced by it, as full control of the computer may have been granted to an attacker.