MariaDB Connector/J versions prior to 3.3.7, 3.4.5, and 3.5.10 improperly handle 8-byte length-encoded integers by truncating values larger than Integer.MAX_VALUE to a signed int without validation. This can cause negative or arbitrary lengths leading to client crashes or oversized memory allocations when interacting with a malicious or compromised server. The vulnerability impacts availability only and requires control over the server side. No confidentiality, integrity, or authentication bypass issues are involved. Fixed versions are available.
MariaDB Connector/J versions 3.0.0 through before 3.3.7, 3.4.0 through before 3.4.5, and 3.5.0 through before 3.5.11 contain a vulnerability in the XAResource.recover() method. The method trusts server-supplied gtrid_length and bqual_length values without validating them against XA specification bounds, leading to potential large memory allocations or exceptions during XA recovery. This can cause availability issues such as crashes or denial of service. Exploitation requires control over the server side of the connection. Fixed versions are 3.3.7, 3.4.5, and 3.5.11.
MariaDB Connector/J versions before 3.3.7, 3.4.5, and 3.5.11 improperly validate LOAD DATA LOCAL INFILE file requests by searching for the file name text anywhere in the SQL command, including inside quoted identifiers and comments. This flaw allows a malicious or compromised server, or a man-in-the-middle, to trick the client into sending arbitrary local files readable by the JVM to the server. The vulnerability affects standard JDBC calls such as DatabaseMetaData.getImportedKeys() and getExportedKeys(). A fix is available that properly parses the SQL command to validate the file request.
MariaDB Connector/J versions 3.0.0 through before 3.3.7, 3.4.0 through before 3.4.5, and 3.5.0 through before 3.5.11 have a vulnerability where the connector does not properly guard against changes to the character_set_results session variable. This allows a malicious or compromised server to switch the character set away from UTF-8 without the client noticing, causing incorrect decoding of query results. This can lead to integrity issues where application-side validation or escaping based on string values can be bypassed. The vulnerability requires control of the server side of the connection and does not impact confidentiality or availability. Fixed versions are 3.3.7, 3.4.5, and 3.5.11.
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
LightSAML versions prior to 4.7.1 and between 5.0.0 and before 5.0.1 contain a vulnerability in the verification of cryptographic signatures on SAML assertions. The flaw allows an attacker to bypass authentication or escalate privileges by exploiting a mismatch in how LightSAML and xmlseclibs validate which assertion a signature covers. This occurs because the signature validation can be tricked into validating a hidden genuine assertion while LightSAML processes an attacker-controlled unsigned assertion. The issue is fixed in versions 4.7.1 and 5.0.1.
CVE-2026-48201 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Fast Velocity Minify versions up to and including 3.5.7. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 7.1.
A Cross-Site Scripting (XSS) vulnerability exists in the Divi Contact Form 7 plugin (cf7-styler-for-divi) up to version 4.1.0. This vulnerability allows improper neutralization of script-related HTML tags, enabling code injection. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation details are provided in the available data.
A vulnerability in GStreamer's gst-plugins-bad H.265 video parser allows a specially crafted H.265 bitstream with a Screen Content Coding (SCC) extension to trigger an integer underflow. This leads to out-of-bounds writes beyond a fixed-size array, causing memory corruption and application crashes. Exploitation requires a malformed H.265 media file and results in denial of service without confidentiality or integrity impact. Red Hat Enterprise Linux 7 and 8 are not affected; RHEL 9, 10, and Red Hat In-Vehicle OS are affected but no fix is currently available. Fedora 44 and rawhide include the fix, while Fedora 43 remains vulnerable.
A PHP Object Injection vulnerability exists in MasterStudy LMS versions up to and including 3.7.55. This vulnerability allows an attacker with low privileges to execute arbitrary code remotely without user interaction, potentially leading to full system compromise.
CVE-2026-116862 is a high severity vulnerability involving unauthenticated broken access control in WP REST Cache versions up to and including 2026.3.1. This flaw allows an attacker to access restricted resources without authentication, potentially leading to exposure of sensitive data. The vulnerability has a CVSS score of 7.5, indicating a significant impact on confidentiality but no impact on integrity or availability.
Trail of Bits fickling versions up to 0.1.12 contain a protection mechanism failure where the _process_import() method trusts imported callables from standard library modules without verifying their behavior. This leads to unsafe calls being marked as likely safe, allowing malicious pickle payloads to execute arbitrary code or write files. The issue affects Python 3.7 through 3.12 and involves modules such as dataclasses, mailcap, and readline. The vendor has added the demonstrated unsafe modules to a denylist on the master branch but no official release patch is available yet.
CVE-2026-62333 is a high-severity vulnerability in the openvm-org OpenVM zkVM framework affecting versions prior to 1.7.0 in the 1.x line and certain prereleases of 2.0 and 2.1. The flaw involves improper input validation in the MemoryMerkleAir component, allowing a malicious prover to fabricate a subtree below a memory leaf and alter the committed memory root without corresponding memory operations. This compromises the soundness of OpenVM proofs using persistent memory. The issue is fixed in OpenVM versions 1.7.0, 2.0.0-rc.3, and 2.1.0-preview.
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
CVE-2026-62335 is an improper input validation vulnerability in openvm-org's OpenVM zkVM framework. Versions before 1.7.0 in the 1.x line, and certain prereleases of 2.0 and 2.1, allow the verify function to accept non-canonical 256-bit values for app executable and VM commitments without verifying they are less than the BN254 scalar field modulus. This can cause ambiguity between the byte-level inputs and the field elements used by the verifier. The issue is fixed in versions 1.7.0, 2.0.0-rc.3, and 2.1.0-preview.
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
CVE-2026-119730 is an address bar spoofing vulnerability in Maxthon Browser for Android versions before 7.5.8.103. It allows remote attackers to misrepresent a page's origin by exploiting the absence of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is used. This can trick users into believing they are on a trusted domain while interacting with attacker-controlled content, potentially leading to credential disclosure via phishing.
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.