pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes excessive CPU consumption when processing many fixed-size fragments, potentially leading to CPU exhaustion if attacker-controlled ASN.1 input is decoded without proper limits. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5, indicating high severity.
CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by Ansible@13 (version 13.7.0 and later). It causes quadratic CPU usage when decoding attacker-controlled schemaless BER, CER, or DER data with many distinct long tag IDs, potentially leading to denial of service by exhausting CPU resources. The flaw arises from inefficient handling of TagSet insertions during decoding. No confidentiality or integrity impacts were observed.
CVE-2026-119196 affects pyasn1 versions through 0.6.4 and causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments. This can lead to CPU exhaustion and denial of service if attacker-controlled ASN.1 data is passed to the decoder. The vulnerability impacts BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).
The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing a costly RSA private-key decryption for each recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON with many recipients. The library caps sizes of other JWE elements but does not limit recipient count. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted before this flag is checked. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High). A fix is available in joserfc version 4.0.0.
Mojolicious versions 7.28 through 9.45 for Perl generate weak HMAC session cookie secrets by default when using the "mojo generate app" tool. This occurs because the tool uses the insecure rand() function to create the secret, which is used for session authentication and integrity. The weakness may allow attackers to brute force session keys. Version 9.46 fixes this by using high-quality randomness. Users must manually replace any previously generated weak secrets to ensure security.
joserfc 1.7.4 has a vulnerability in its compact JWS size guard where it allocates attacker-controlled segments before rejecting oversized inputs. This occurs because the library calls bytes.split() on the input before validating its length, causing an additional payload-sized memory allocation. The flaw allows an attacker to cause excessive memory usage before the size limit triggers rejection. A fix is available in version 3.4.2_1.
The W3 Total Cache plugin for WordPress up to and including version 2.10.7 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping when HTML Minify is enabled with the default 'mfunc' entry in the ignored-comment stems list. Exploitation requires an attacker to predict a time-based placeholder namespace by reading the server clock from the HTTP Date header. Successful exploitation allows injection of arbitrary scripts that execute when users access the affected pages.
The WP Job Portal WordPress plugin up to version 2.7.0 is vulnerable to stored cross-site scripting (XSS) via the 'degreetitle' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The plugin allows self-registration, enabling any visitor to create an account capable of exploiting this vulnerability.
The W3 Total Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 2.10.7. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires that a Pro license was previously active with REST caching enabled but is now inactive while Disk Enhanced page caching remains configured, and that the attacker has a previously approved commenter identity.
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values — diverting all subsequent Hustle form lead submissions to the attacker's ESP tenant — and, for HubSpot, irreversibly delete the operator's OAuth token, OAuth referer, and OAuth current-page option rows. This requires the attacker to hold the plugin-granted hustle_create capability (e.g., an Editor delegated hustle_create but not hustle_edit_integrations via Hustle's Permissions tab), which allows them to load a Hustle module wizard page and obtain the hustle_provider_action nonce needed to reach the vulnerable handlers.