Zohocorp ManageEngine DDI Central versions below 6301 are affected by a PowerShell injection vulnerability. This flaw arises from insufficient validation of user-supplied TXT record values in Windows DNS operations, allowing potential injection of malicious PowerShell commands.
The VibeBP WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 1.9.9.8.1. Authenticated users with Subscriber-level access or higher can exploit this flaw by manipulating the set_email_notification_settings() function to update their own 'wp_capabilities' user meta value, thereby granting themselves administrator privileges.
The CourseCure Courses plugin for WordPress versions up to and including 1.5.1 contains a privilege escalation vulnerability. This flaw arises from a missing capability check in the ajax_save_settings() function, allowing authenticated users with subscriber-level access or higher to modify WordPress options without proper authorization. Attackers can exploit this to set the default user role to administrator and enable user registration, thereby creating new administrator accounts.
An information disclosure vulnerability exists in the MISP Modules website component's external tools management interface. The /external_tools/list endpoint returns stored API keys in its JSON response without requiring authentication, exposing these keys to any network-reachable client. Additionally, the browser-based edit form pre-populates the API key field with the stored credential, exposing it in the DOM and client memory. This vulnerability allows attackers to obtain API keys used for authenticating submissions to external analysis or enrichment services, potentially enabling impersonation of the MISP instance or unauthorized access to external services. The impact is limited to confidentiality; no integrity or availability issues are indicated.
An untrusted URL redirection vulnerability exists in In Progress® Telerik® UI for .NET MAUI versions prior to 16.0.0. This flaw affects the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling components. An unauthenticated attacker can exploit this by crafting a document or PDF containing a link with a non-allowlisted URI scheme, which when opened by a user, can launch arbitrary operating system protocol handlers with attacker-controlled arguments.
A resource exhaustion vulnerability exists in the Qt Framework's QWebSocket and QWebSocketServer classes within the Qt WebSockets module. This vulnerability could allow an attacker to cause denial of service by exhausting resources. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No affected versions or patch information are provided, and there are no known exploits in the wild.
A host key verification flaw exists in ansible-pylibssh and the ansible.netcommon libssh connection plugin when trust-on-first-use is enabled. If a host's SSH key changes but is already present in known_hosts, the changed key is accepted without warning, allowing a man-in-the-middle attacker to impersonate the host and potentially capture credentials. Default configurations with host key checking enabled and trust-on-first-use disabled are not affected, and non-interactive runs fail closed.
The MISP Modules website component has a vulnerability in its external tools management endpoints that allows unauthenticated attackers to add, delete, modify, and toggle external tools without authorization. This occurs because the external tools handlers do not enforce the administrator authentication policy even when ADMIN_PASSWORD is set. The flaw affects the external_tools Flask blueprint and enables bypass of intended access controls. Installations without an admin password are designed to allow open management access, so the vulnerability is conditional on ADMIN_PASSWORD being configured.
CVE-2026-126643 is a cleartext storage vulnerability in the AAP Gateway Operator used in Red Hat Ansible Automation Platform 2.5 and later. The operator copies a protected resource-server secret in plaintext into the AutomationController custom resource, exposing it to any user with read access to that resource but without permission to read the original Kubernetes Secret. This breaks RBAC separation and risks disclosure of a sensitive authentication secret. The secret may also be exposed in Kubernetes API storage, GitOps histories, manifests, and audit data. Disclosure could allow impersonation of a trusted Controller service and access to privileged APIs.
A deserialization of untrusted data vulnerability exists in Telerik UI for WPF versions prior to 2026.4.1110. This flaw allows an attacker to perform unauthorized actions within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8. No known exploits are reported in the wild, and no patch links are provided in the available data.
A CRLF injection vulnerability exists in ibi WebFOCUS affecting versions 9.1, from 9.2 through 7, and from 9.3 through 7. This vulnerability involves improper neutralization of CRLF sequences, which can lead to security issues such as HTTP response splitting or header injection.
An improper control of code generation vulnerability exists in Telerik UI for WPF versions prior to 2026.4.1110. This flaw allows an attacker to execute unauthorized code within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8.
A link-following flaw exists in the authorized_key module of the ansible.posix collection, allowing an unprivileged local user to create or overwrite files in directories they do not own by replacing their ~/.ssh directory with a symlink. When an operator runs the authorized_key task as root, the module follows the symlink and writes files to the attacker-controlled location. This does not allow privilege escalation but can impact system integrity and availability, for example by disrupting package management. Exploitation requires local access and running the task as root against the symlinked path. Red Hat rates the impact as low.
A deserialization of untrusted data vulnerability exists in Telerik UI for WinForms versions prior to 2026.4.1111. This flaw allows an attacker to perform unauthorized actions within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8.
A blind SQL injection vulnerability exists in the public endpoint public/webhook/receiver.php of the WhatsApp module for Dolibarr version 1.9. The vulnerability arises because the phone number value from the data.key.remoteJid JSON parameter is used in an SQL query without proper escaping or parameterization. When the WHATSAPP_WEBHOOK_ALLOW option is enabled, an unauthenticated attacker can exploit this flaw using timing-based techniques to extract database information and potentially disrupt service.
An out-of-bounds read vulnerability exists in the Guththila XML parser wrapper used by Apache Axis2/C. When processing certain malformed XML inputs, the parser may read memory beyond the bounds of a lookup table, potentially causing incorrect parsing or process crashes. This can be triggered by an unauthenticated client sending crafted XML requests. The vulnerability affects Apache Axis2/C versions through 2.0.0. Fixes have been committed and will be included in the next release.
An improper control of code generation vulnerability exists in Telerik UI for WinForms versions prior to 2026.4.1111. This flaw allows an attacker to supply a crafted expression that can execute unauthorized code within the context of the affected application. The vulnerability has a high severity rating with a CVSS score of 7.8.
A cross-site scripting (XSS) vulnerability exists in Apache Sling XSS before version 2.4.14. The issue arises because the xssAPI.getStyleToken() method improperly neutralizes input, allowing markup in unquoted URLs during web page generation. This flaw could enable injection of malicious scripts into web pages.
In Progress Telerik Reporting versions prior to 20.3.26.1110 contain a vulnerability in the SVG processing engine where XML external entity references are improperly restricted. This flaw allows an authenticated user with low privileges who can supply SVG content to a report to read local or UNC files or cause server-side network requests from the report rendering host. The vulnerability arises because external XML entities in SVG content are resolved without enforcing the configured strict resource resolver and report path validation. The disclosed data is limited by the rendering process permissions and the report output exposure.
A deserialization of untrusted data vulnerability exists in In Progress® Telerik® Reporting versions prior to 20.3.26.1110. This flaw affects the .NET Framework report designers and allows a local attacker with low privileges to execute arbitrary code within the designer process when performing certain editing operations.