The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires HTML Minify to be enabled with the default 'mfunc' entry present in the ignored-comment stems list, and exploitation depends on the attacker predicting the md5(time()) placeholder namespace by reading the server clock via the HTTP Date response header within the applicable time window.
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Pro license was previously active with REST caching enabled and has since become inactive while Disk Enhanced page caching remains configured, and that the attacker holds a previously approved commenter identity.
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor.
This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that are patched against that advisory.
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
This vulnerability, identified as CVE-2026-119025, involves OS command injection via PowerShell on Windows in Microsoft software versions 3.0. The description references the Microsoft Support Lifecycle but does not provide specific technical details or impact information. No CVSS score or patch information is available.
CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component of Keycloak. It affects multiple packages and allows for potential remote code execution or denial of service. The flaw exists in the c/dec/decode function of the Brotli decoder. Fixed versions 26.4.2-r4 and 26.7.5-r3 address this issue.
CVE-2026-110176 is a high-severity authorization vulnerability in the Drupal 7 File Force Download module versions 7.1.0 through 7.1.2. The module improperly grants access to files in the temporary:// scheme or other stream wrappers by returning download headers without proper access checks when the download=1 parameter is appended to the file URL. This allows unauthenticated users to bypass intended access restrictions and download files they should not be able to access. The issue does not affect files in the public or private schemes. The vulnerability is fixed in version 7.1.3.
Multiple security issues were addressed in the warewulf4-4.7.1-2.1 package included in the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities affecting this package version. No specific details about the nature of the vulnerabilities or their impact are provided.
@sigstore/oci versions prior to 0.7.2 improperly send the registry Authorization header to a cross-host blob-upload Location URL. This occurs because the Authorization header is set as a default on the HTTP client and is attached to all requests, including those redirected to a different host for blob uploads. The vulnerability allows a malicious or compromised registry to capture credentials by redirecting blob uploads to an attacker-controlled host.
MariaDB Connector/J versions before 3.3.7, 3.4.5, and 3.5.11 contain a vulnerability where a rogue or MitM server can cause the client to allocate large amounts of heap memory based on server-declared lengths in OK packets. This can lead to excessive garbage collection pressure and potentially an OutOfMemoryError, impacting availability. The flaw arises because the client allocates memory before validating that the declared lengths fit within the actual packet size. The issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
MariaDB Connector/J versions prior to 3.3.7, 3.4.5, and 3.5.10 improperly handle 8-byte length-encoded integers by truncating values larger than Integer.MAX_VALUE to a signed int without validation. This can cause negative or arbitrary lengths leading to client crashes or oversized memory allocations when interacting with a malicious or compromised server. The vulnerability impacts availability only and requires control over the server side. No confidentiality, integrity, or authentication bypass issues are involved. Fixed versions are available.
MariaDB Connector/J versions 3.0.0 through before 3.3.7, 3.4.0 through before 3.4.5, and 3.5.0 through before 3.5.11 contain a vulnerability in the XAResource.recover() method. The method trusts server-supplied gtrid_length and bqual_length values without validating them against XA specification bounds, leading to potential large memory allocations or exceptions during XA recovery. This can cause availability issues such as crashes or denial of service. Exploitation requires control over the server side of the connection. Fixed versions are 3.3.7, 3.4.5, and 3.5.11.
MariaDB Connector/J versions before 3.3.7, 3.4.5, and 3.5.11 improperly validate LOAD DATA LOCAL INFILE file requests by searching for the file name text anywhere in the SQL command, including inside quoted identifiers and comments. This flaw allows a malicious or compromised server, or a man-in-the-middle, to trick the client into sending arbitrary local files readable by the JVM to the server. The vulnerability affects standard JDBC calls such as DatabaseMetaData.getImportedKeys() and getExportedKeys(). A fix is available that properly parses the SQL command to validate the file request.
MariaDB Connector/J versions 3.0.0 through before 3.3.7, 3.4.0 through before 3.4.5, and 3.5.0 through before 3.5.11 have a vulnerability where the connector does not properly guard against changes to the character_set_results session variable. This allows a malicious or compromised server to switch the character set away from UTF-8 without the client noticing, causing incorrect decoding of query results. This can lead to integrity issues where application-side validation or escaping based on string values can be bypassed. The vulnerability requires control of the server side of the connection and does not impact confidentiality or availability. Fixed versions are 3.3.7, 3.4.5, and 3.5.11.
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
LightSAML versions prior to 4.7.1 and between 5.0.0 and before 5.0.1 contain a vulnerability in the verification of cryptographic signatures on SAML assertions. The flaw allows an attacker to bypass authentication or escalate privileges by exploiting a mismatch in how LightSAML and xmlseclibs validate which assertion a signature covers. This occurs because the signature validation can be tricked into validating a hidden genuine assertion while LightSAML processes an attacker-controlled unsigned assertion. The issue is fixed in versions 4.7.1 and 5.0.1.
Maxthon Browser for Android versions before 7.5.8.103 have an address bar spoofing vulnerability. This flaw allows remote attackers to create a fake address bar during fullscreen mode, misleading users about the true origin of the web page. The vulnerability arises because the browser lacks a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is used. Attackers can exploit this to display a counterfeit address bar showing a trusted domain while presenting attacker-controlled content, potentially tricking users into disclosing credentials via phishing.