P-Net versions before 1.0.3 contain a vulnerability where the application alarm callback receives a data length derived from a variable part length field without verifying it against the actual frame length. This can cause the callback to process an excessively large length value, leading to out-of-bounds reads if the application copies that many bytes. Exploitation requires an established Application Relationship and adjacent network access. Applications that do not use the alarm data are not affected.
A PHP Object Injection vulnerability exists in the Extra Fees Plugin for WooCommerce versions up to and including 4.4.0. This flaw allows an attacker with contributor-level privileges to inject malicious PHP objects, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
A PHP Object Injection vulnerability exists in Zippy versions up to and including 1.7.0. This vulnerability allows an attacker with high privileges to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
P-Net versions prior to 1.0.3 contain a vulnerability where the software does not verify the presence of a complete block header before reading the next block in DCP Set and Identify requests. This can lead to reading beyond the receive buffer boundary or processing a block with an underflowed length, potentially causing a crash or limited memory disclosure. Exploitation requires adjacent network access.
A PHP Object Injection vulnerability exists in WPCargo Track & Trace versions up to and including 8.0.5. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service due to unsafe deserialization of user input.
A PHP Object Injection vulnerability exists in Dynamic QR Code – generator versions up to and including 1.0.1. This flaw allows an attacker with limited privileges to execute arbitrary code or cause denial of service by injecting crafted PHP objects.
Adobe Digital Editions contains a path traversal vulnerability that allows an attacker to bypass security restrictions and gain unauthorized write access. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability changes the security scope but does not impact confidentiality or availability.
P-Net versions before 1.0.3 contain a vulnerability where the Application Relationship (AR) and RPC session are not released when an RPC request is rejected due to incorrect data representation endianness. This causes sessions to remain allocated, leading to exhaustion of available sessions. Once exhausted, the device stops responding to new RPC requests until restarted. This can be exploited remotely by an unauthenticated attacker to cause a denial of service.
P-Net versions before 1.0.3 contain a vulnerability in the get_check_peer() function where the LengthPeerStationName field of a CheckPeers block is not properly validated. This allows a crafted block to write up to 15 bytes beyond the 241-byte buffer allocated for the peer station name, potentially causing a crash or arbitrary code execution. Exploitation requires establishing a session with adjacent network access.
A vulnerability in OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 allows acceptance of extraneous untrusted data alongside trusted data. This flaw leads to accessing functionality that is not properly constrained by access control lists (ACLs). The vulnerability is rated critical with a CVSS 4.0 score of 9.9.
P-Net versions before 1.0.3 contain a vulnerability where the software dereferences a NULL AR pointer when processing an implicit read request lacking a valid target AR UUID for certain record indices. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the affected device.
P-Net versions prior to 1.0.3 contain an integer underflow vulnerability in the function pf_cpm_c_data_ind(). This flaw occurs when processing a received cyclic data frame while the consumer is in the FRUN or RUN state. The offset for the APDU status is calculated using 16-bit arithmetic as the frame length minus 4 without verifying the frame length, allowing a crafted short frame to cause an offset wraparound. This leads to out-of-bounds reads from the receive buffer, potentially causing a denial of service crash or disclosure of memory contents.
CVE-2026-112255 is a vulnerability in OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.x, 6.5.0.0 through 6.5.0.x, and 6.6.0.0 through 6.6.1.0. It involves initialization of a resource with insecure default settings that allow excessive allocation. The issue arises from allowing creation or recreation of Unauthenticated Endpoints without proper network restrictions. The recommended fix is to configure the system to disallow creation/recreation of Unauthenticated Endpoints or restrict this capability to trusted networks via a non-empty whitelist. The 6.6.2.0 release includes best practice guidance for secure configuration.
P-Net versions before 1.0.3, when compiled with the PNET_OPTION_AR_VENDOR_BLOCKS option enabled, contain a vulnerability where a data length is parsed from a field in the ARVendorBlock request that is not part of the block definition. This length is used to copy bytes into a fixed-size buffer without proper bounds checking, leading to an out-of-bounds write. This flaw can cause a crash resulting in denial of service or potentially allow arbitrary code execution. The vulnerable option is disabled by default.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary commands due to improper control of code generation. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
P-Net versions before 1.0.3 have a vulnerability where handling a read request for the PDPortDataCheck record with subslot 0 causes an infinite loop. This loop prevents the request from completing and causes the device to stop responding. A remote unauthenticated attacker can exploit this to cause a denial of service.
P-Net versions before 1.0.3 contain a vulnerability where a NULL AR pointer is dereferenced in the function pf_fspm_cm_read_ind() during handling of an implicit read request without a valid target AR UUID. This occurs if the application has registered a read callback. A remote unauthenticated attacker can exploit this to cause a denial of service by crashing the device.
P-Net versions prior to 1.0.3 contain a vulnerability in the pf_eth_recv() function where the length of a received Ethernet frame is not properly validated before accessing certain fields. This improper validation, especially in the VLAN tag processing loop without an upper bound, can lead to reading beyond the receive buffer. Such out-of-bounds reads may cause a denial of service (crash) or unintended disclosure of memory contents.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements in OS commands, leading to command injection. The vulnerability has a high severity with a CVSS score of 8.8.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Chained Quiz versions up to and including 1.4.1. This flaw allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.