FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.
A memory leak vulnerability exists in the clnttcp_call() function of lib/rpc/clnt_tcp.c in MIT Kerberos 5 (krb5). This flaw causes the RPC reply verifier to not be freed between retries, allowing remote attackers to cause denial of service by exhausting client memory through injected RPC replies with mismatched XIDs or triggering authentication retries. The issue affects client-side RPC processing and does not impact authentication servers or default daemon operations. Exploitation requires control over a remote RPC endpoint or interception of client network traffic and a continuous flood of malformed responses during an active transaction.
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
A vulnerability in MIT Kerberos 5 (krb5) 1.11 and later allows remote attackers to cause a denial of service by sending specially crafted unauthenticated AS-REQ or TGS-REQ messages with a large number of elements in a SEQUENCE OF field over TCP. This triggers excessive CPU consumption in the Kerberos Key Distribution Center (KDC), degrading its availability. The issue arises because the decode_sequence_of() function grows the decoded element array one entry at a time, leading to inefficient processing. The vulnerability does not allow unauthorized data disclosure or remote code execution. Mitigation involves restricting TCP port 88 access to trusted networks to prevent exploitation from untrusted sources.
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
The AUTH_GSSAPI handler in MIT Kerberos 5 (krb5) version 1.5.2 and later contains a vulnerability that allows remote attackers to cause a denial of service by exhausting memory in the kadmind service. This occurs because repeated failed AUTH_GSSAPI_INIT requests allocate client state that is only freed after a 15-minute timeout, enabling memory accumulation faster than reclamation. The kadmind service is not enabled by default on standard Red Hat Enterprise Linux installations and is typically confined to dedicated Kerberos KDC environments.
An Incorrect Privilege Assignment vulnerability exists in Tobias WP2LEADS plugin versions up to 3.5.17, allowing privilege escalation. This flaw enables an attacker to gain elevated privileges beyond what is intended by the application. The vulnerability has a CVSS v3.1 score of 7.3, indicating a high severity level.
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-114031 is a local privilege escalation vulnerability in Illumio Core VEN for Windows. It arises from incorrect permission assignments in the VEN installer, which grants the LOCAL SERVICE account full access to critical VEN data and installation folders. Because the SYSTEM-privileged illumio-ven-ctl component reads and trusts these files, an attacker with NT AUTHORITY\LOCAL SERVICE privileges can modify the VEN configuration to execute arbitrary commands as SYSTEM.
MuhammaraJS versions prior to 6.0.5 contain a NULL pointer dereference vulnerability in the PDFParser::CreateFilterForStream() function. This occurs when processing a PDF stream that uses the LZWDecode filter with a DecodeParms dictionary missing the EarlyChange key. An attacker supplying a crafted PDF can cause the application to crash, resulting in a denial of service. The issue is resolved in version 6.0.5.
Wagtail CMS versions prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 contain a vulnerability where users with the submit translations permission can copy a source page they cannot edit into a translation. This allows unauthorized viewing of the source page content despite lacking edit permissions. The issue is addressed in the specified fixed versions.
Wagtail versions prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 have an issue where ETag conditional request processing occurs before document permission and filename checks. This allows an unauthenticated attacker who knows a document ID and a candidate SHA1 hash to determine if that hash exists in the document library by submitting If-Match or If-None-Match headers. The vulnerability does not expose document contents, filenames, or other metadata beyond confirming the presence of known hashes. The issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
Wagtail versions prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 have a vulnerability in the Documents and Images API V2 where descendant collections of directly restricted collections are not properly excluded. This allows API users to list filenames and names of documents and images in descendant collections that should be private. The issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.