VoiceSentinel versions from 2.2.1 up to but not including 3.3.1 have a race condition in the optional report buffer feature. This race occurs between retention cleanup and transcript writes, leading to possible loss, duplication, or corruption of transcript data. The issue can also cause unbounded disk growth, potentially exhausting storage and crashing the host or other services. The feature is disabled by default and must be enabled to be affected. The vulnerability is fixed in version 3.3.1.
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An attacker controlling a domain can return a public address during validation and an internal address during the connection, bypassing the internal-address protection through `DNS rebinding`. The command takes its address directly from user input and its developer-only gate is disabled in normal deployments, so any member of a server with the bot can trigger the flaw without special permissions. Requests are restricted to `HTTPS on port 443`, and content is returned only when the response is a `genuine image`. The impact is therefore mostly blind internal probing with limited retrieval of image responses from loopback or internal endpoints, not arbitrary internal-data disclosure. Common cloud metadata services using plain HTTP on another port are not reachable through this path. This issue is fixed in version 1.1.9.
CVE-2026-119117 is a vulnerability in the Amazon Kinesis Producer Library for Java versions before 1.0.8 and up to 0.15.12, where sensitive AWS credentials may be exposed. When the library's logger is set to DEBUG level, these credentials can be written into log files. Additionally, the credentials are passed as command-line arguments to native child processes, making them accessible to local users via the process argument list.
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.
CVE-2026-39739 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite, specifically in the header-footer-elementor component. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability affects versions from initial release up to 2.9.5 and has been fixed in version 2.9.6.
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot.
When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so that table was never included in the authorization check. An authenticated user who is authorized for at least one table can therefore read columns from any dimension table in the cluster, including tables they have no access to, and can retrieve arbitrary rows of it by supplying primary key values directly. Per-principal row-level security filters configured on the dimension table are likewise not applied.
The multi-stage query engine is not affected.
This issue affects Apache Pinot: through 1.5.1
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
The npm package vas-tops2-reportingui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package vas-tops2-core-clients-search contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package '@sxm-content-creators/tools-ds' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not eliminate all malicious software introduced by it, as full control of the computer may have been granted to an attacker.
The npm package @pcb-dp/qa-commons contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the extent of the compromise, simply removing the package may not eliminate all malicious software. Secrets and keys should be rotated from a different, secure computer.
The npm package vas-tops2-core-client-cleanup-ui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @tops2/digital-assistant-ui contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package vas-tops2-digital-assistant-ui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, clean computer. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.