RT-Thread versions through 5.3.0 have a memory corruption vulnerability in the legacy USB CDC virtual COM port driver. This flaw occurs because the rx_ringbuffer is aliased as a Serial V2 rt_serial_rx_fifo in the _function_enable() function. When a connected USB host configures the CDC device, it can cause writes beyond the ring buffer into adjacent memory structures and trigger an invalid rt_free() call upon device close. This results in a denial of service condition.
This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile (binary JSON), XML, CBOR (another kind of binary JSON), YAML.
Security Fix(es):
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-19739 is a denial of service vulnerability in the Zephyr Bluetooth Link Layer controller affecting versions from 3.4.0 up to but not including 4.5.0. The flaw involves improper handling of retained RX nodes during Connection Update or Connection Parameter procedures, which can lead to either a fatal controller error or exhaustion of the controller's RX buffer pool. This vulnerability can be triggered remotely by a peer device without requiring pairing, bonding, or encryption, causing persistent denial of service until the device is rebooted. There is no memory corruption or information disclosure associated with this issue.
CVE-2026-19935 is a use-after-free vulnerability in the Zephyr Bluetooth LE host's handling of L2CAP connection-oriented channel (CoC) data when using dynamic PSMs (0x0080-0x00FF). The issue arises because the channel teardown process does not cancel a queued work item (rx_work) that references the channel, allowing a remote unauthenticated peer to trigger use-after-free by sending a data K-frame followed immediately by an L2CAP Disconnect Request. This can lead to memory corruption or workqueue malfunction. The vulnerability affects Zephyr versions from 2.0.0 through 4.4.2 and has a CVSS 3.1 score of 7.5 (high severity).
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the saveDatarule handler of the SysDepartRoleController. This flaw allows low-privileged authenticated users to modify department role data rules by sending crafted parameters. Exploitation can lead to unauthorized widening of row-level data access or alteration of filtering rules for other department roles.
A SQL injection vulnerability exists in erzhongxmu Jeewms up to version 3.7 in the getTreeData function of the Autocomplete Data Handler component. This vulnerability allows remote attackers with low privileges to manipulate the searchVal argument, potentially leading to unauthorized data access or modification. A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is recommended to remediate the issue.
Vearch versions 3.5.2 through 3.5.9 have an authorization vulnerability in the Role.HasPermissionForResources function. This flaw causes the system to ignore stored ReadOnly or None privilege levels for resources assigned to a role. As a result, authenticated non-root users can perform unauthorized actions such as upserting and deleting documents despite having only read-only access. They can also escalate their privileges by calling PUT /roles to grant themselves WriteRead access, potentially gaining cluster administrator rights.
Traccar versions through 6.16.0 have a vulnerability in the password recovery process where reset tokens can be reused as session credentials. This occurs because the TokenManager does not bind tokens to a specific purpose, allowing attackers with a leaked reset link to gain full session access or change passwords. The attacker can maintain access for seven days even after the victim resets their password.
UnicomAI Wanwu versions before 0.6.3 have an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' applications by manipulating the appId parameter. This flaw enables attackers to send DELETE requests with guessed sequential assistant IDs to remove victims' applications, workflows, conversations, and related data permanently.
phpMyFAQ versions 4.1.0 through 4.1.10 contain a missing authorization vulnerability in the MCP server's faq_search tool. This flaw allows MCP clients to bypass user and group permission checks when performing search queries, enabling unauthorized access to restricted FAQs. The vulnerability arises because the Search::searchDatabase() function does not enforce access controls on the returned FAQ content.
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
The MultiVendorX WordPress plugin versions up to 5.0.19 contain an incorrect authorization vulnerability that allows users with the store_owner role to modify marketplace-wide settings via a REST API endpoint. This flaw permits unauthorized changes to commission, payout, and onboarding settings by sending POST requests to the settings endpoint, bypassing proper authorization checks.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController. This endpoint lacks proper Shiro permission or role checks, allowing any authenticated user with low privileges to retrieve sensitive database connection details including JDBC URLs, usernames, and decrypted passwords.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to remove members from user groups without proper permission checks. This occurs via the DELETE /sys/user/deleteUserGroupBatch endpoint, allowing attackers to specify any groupId and userIds to delete user-group associations, bypassing tenant and administrative controls.
JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to access other users' in-application messages. The vulnerability exists in the getOne handler of SysAnnouncementSendController, where attackers can use delivery record IDs obtained from the unprotected /sys/sysAnnouncementSend/list endpoint to retrieve message details such as titles, bodies, senders, and recipients.
JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to access other users' AI voice generation history. By exploiting the userId parameter in the GET /airag/voice/listByUser endpoint, an attacker who knows another user's ID can retrieve sensitive data including text-to-speech inputs, voice settings, timestamps, and generated audio file metadata stored in Redis. This vulnerability has a medium severity rating with a CVSS score of 4.3.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin versions up to 1.0.10. This flaw allows object injection, potentially leading to full system compromise without requiring user interaction or privileges. The vulnerability has a CVSS 3.1 score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
TencentCloud Octop versions up to 1.0.2b6 have a missing authorization vulnerability that permits authenticated low-privileged users to access stored provider API keys. The flaw allows these users to retrieve plaintext LLM and voice provider API keys by querying specific API endpoints that only validate JWT tokens without proper authorization checks.
AniWorld Downloader versions before 5.3.0 have a vulnerability in the WebUI login handler that allows unauthenticated attackers to perform unlimited authentication attempts without throttling. This flaw enables attackers to enumerate usernames based on response timing and brute-force passwords to potentially take over user accounts.