CVE-2026-125445 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Infomaniak Network's VOD Infomaniak product up to version 1.5.16. The vulnerability allows an attacker to trick authenticated users into performing unwanted actions. A fix is available in version 1.5.17.
X.Org X11 libXrender runtime library
Security Fix(es):
* libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-125782 is a missing authorization vulnerability in Blubrry Podcasting PowerPress Podcasting affecting versions prior to 11.18.3. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity score of 4.3 and does not affect confidentiality or availability. A fix is available in version 11.18.3.
Fortinet released 89 security advisories addressing nearly 100 vulnerabilities across multiple products, including FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE, and FortiClient. Among these, approximately 17 are critical-severity flaws that could enable arbitrary code execution, authentication bypass, account takeover, and other serious impacts. No exploitation in the wild has been reported. The vulnerabilities were discovered using AI-enhanced security testing integrated by Fortinet.
CVE-2026-125435 is a vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) that allows insertion of sensitive information into sent data. This flaw affects versions from the initial release up to 3.1.3. The vulnerability could lead to unauthorized retrieval of embedded sensitive data. A fix is available in version 3.1.4.
CVE-2026-124411 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force's SureCart plugin affecting versions before 4.13.0. The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 4.13.0.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (6ca0694213fab27d0292d43aee954b81c13e551a81563903fb9afd7e54a9dda2)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.
Security Fix(es):
* com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-124417 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress. It affects versions from initial release up to 2.7.2. The flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue is fixed in version 2.8.0.
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.
Security Fix(es):
* libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)
* libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)
* libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)
* libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-124269 is a missing authorization vulnerability in the Happy Addons for Elementor plugin by weDevs. The flaw allows exploitation due to incorrectly configured access control, affecting versions from initial releases up to 3.51.0. A fix is available in version 3.51.3. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-124262 is a medium severity vulnerability in the Igor Funa Ad Inserter plugin that allows improper neutralization of script-related HTML tags, leading to basic cross-site scripting (XSS). This affects versions prior to 2.8.20. The vulnerability can enable code injection via crafted input. A fix is available in version 2.8.20.
The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.
Security Fix(es):
* gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062)
* gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257)
* gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258)
* gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260)
* gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.
Security Fix(es):
* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Core part of Jackson that defines Streaming API as well as basic shared abstractions.
Security Fix(es):
* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.
Security Fix(es):
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.
Security Fix(es):
* xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.