Search: 5.1.8.7

CVE-2026-111461 is an OS command injection vulnerability in the Moxa OnCell G3150A-LTE Series devices. It occurs when the SMS management functionality is enabled and configured. A remote attacker with required privileges can exploit insufficient input validation in this functionality to execute arbitrary commands on the device. The vulnerability has a high severity with a CVSS score of 7.5.

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.

A cross-site scripting (XSS) vulnerability exists in the chat.php file of the MD-MAFUJUL-HASAN Online-Payroll-Management-System up to commit a8902bf64575e325f6d6bf93a55f7bd273ec58cd. The vulnerability arises from manipulation of the ID argument and can be exploited remotely. The project has not yet responded to the issue report, and no fixed versions or patches are currently available. The vulnerability has a low severity score of 3.5 (CVSS 3.1).

DevilutionX versions 1.4.0 through 1.5.5 contain an out-of-bounds read vulnerability in the bundled libmpq library. This flaw occurs in the libmpq__file_number_from_hash function, allowing attackers to read heap memory by supplying unchecked block_table_index values. Exploitation requires placing a crafted .mpq archive, such as a mod, in the game's data path, which can cause the game to read beyond intended memory bounds and crash.

DevilutionX versions 1.4.0 through 1.5.5 contain a heap buffer overflow vulnerability in the bundled libmpq library. The flaw occurs in the libmpq__archive_dup routine when opening specially crafted MPQ archives with a block table count exceeding the hash table count. This causes a heap overflow via memcpy during game startup, leading to a crash.

OpenPanel versions before 3.0.0 have an SQL injection vulnerability that allows authenticated users to bypass tenant scoping. This occurs because unescaped profile filter names are injected into a JOIN subquery, enabling attackers to manipulate the query and read events from all projects. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.

WWBN AVideo versions prior to 29.5.0 have a local file inclusion (LFI) vulnerability. This flaw allows unauthenticated attackers to include and execute PHP files outside the intended locale directory by exploiting crafted Accept-Language headers. The vulnerability arises due to insufficient sanitization of traversal sequences like ....// in the setLanguage() function, enabling bypass of single-pass removal mechanisms.

A vulnerability in SourceCodester Online Food Ordering System 1.0 allows remote attackers to bypass authentication by manipulating the ID argument in the admin/delete_admin.php file. This issue can lead to unauthorized actions without requiring user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.5. Public exploit code has been disclosed, but there are no known exploits in the wild. No patch or remediation information is currently available.

FLTK versions through 1.4.5 have an integer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw causes an undersized pixel buffer allocation based on file-supplied width and height values. An attacker can craft a BMP or ICO file with large dimensions that triggers a heap buffer overflow during row decoding, leading to heap corruption.

Multiple security issues were addressed in the krb5-1.22.2-5.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the Kerberos 5 implementation in this distribution. No specific details about the vulnerabilities or their impact are provided.

Multiple security issues were addressed in the helmsman-4.0.5-1.1 package for openSUSE Tumbleweed. These fixes are included in the GA media release. No specific details about the vulnerabilities or their impact are provided.

A double free vulnerability exists in libyal libmsiecf through version 20260525 in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with an oversized unknown_offset in a partial URL record. The vulnerability can cause forensic tools processing such files to crash. The CVSS 3.1 base score is 5.5, indicating a medium severity impact primarily affecting availability.

FLTK versions up to and including 1.4.5 have a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw occurs when processing BMP or ICO files with a colors_used field value exceeding 256, which overflows a 768-byte colormap array. Exploitation can lead to application crashes or potentially allow code execution.

A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.

A vulnerability in go-jose versions prior to 4.1.5 allows an attacker to cause a denial of service by triggering a stack overflow through deeply nested JSON arrays or objects. This uncontrolled recursion exceeds Go's stack limit during parsing of attacker-controlled JSON. The issue is fixed in version 4.1.5.

A cross-site scripting (XSS) vulnerability exists in the lxsmnsyc seroval library's JavaScript-output APIs prior to version 1.0.0 and from 1.5.5 up to but not including 1.6.10. The issue arises when regular expressions containing a less-than character are serialized without proper escaping for embedding in HTML script elements. This can allow an attacker to inject malicious scripts if untrusted input is serialized and embedded in a web page. The vulnerability is fixed in version 1.6.10.

CVE-2026-113913 is a vulnerability in Apple iOS and iPadOS where processing web content may disclose sensitive information due to an input validation issue. The flaw affects multiple Apple operating systems and has been addressed with improved input validation. Fixed versions include iOS 26.7.2, iOS 27.2, iPadOS 26.7.2, iPadOS 27.2, and macOS versions 15.8.2 and 27.2. The vulnerability has a medium severity rating with a CVSS score of 6.5.