An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
CVE-2026-103226 is a stack-based buffer overflow vulnerability in Artifex Ghostscript affecting the function type1_callsubr in the Pdfwrite component. It affects versions 10.07 and 10.09. The vulnerability allows remote exploitation and public exploit code exists. Upgrading to version 10.08.0 addresses the issue.
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges.
This issue was fixed in version 10.08.0.
CVE-2026-18626 is an out-of-bounds read vulnerability in RTI Connext Professional Core Libraries. It affects multiple versions ranging from 5.0.0 up to but not including certain fixed versions in the 5.x, 6.x, and 7.x series. The flaw allows reading beyond intended buffer boundaries, potentially leading to information disclosure or application instability. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.8. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
CVE-2026-18462 is a high-severity vulnerability in RTI Connext Professional Core Libraries involving integer overflow or wraparound and improper access control. It allows shared resource manipulation in affected versions. The flaw impacts versions 6.1.0, 7.0.0 up to but not including 7.3.1.6, and 7.4.0 up to but not including 7.7.0.1. The vulnerability has a CVSS 4.0 base score of 7.3, indicating significant risk but requiring local access with high attack complexity and privileges. No known exploits are reported in the wild. No vendor patch or remediation details are provided in the input data.
CVE-2026-18461 is a critical vulnerability in RTI Connext Professional Core Libraries involving an externally-controlled format string, leading to format string injection. It affects versions from 7.5.0 up to but not including 7.7.0.1, and from 7.3.0.10 up to but not including 7.3.1.6. The vulnerability has a high CVSS 4.0 score of 9.2, indicating severe impact if exploited. No known exploits are reported in the wild, and no vendor patch links are provided in the data.
CVE-2026-18460 is an off-by-one error vulnerability in RTI Connext Professional Core Libraries that allows out-of-bounds write leading to buffer overflow. It affects versions from 7.0.0 up to but not including 7.3.1.6, and from 7.4.0 up to but not including 7.7.0.1. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No known exploits are reported in the wild. No vendor patch or official fix information is provided in the available data.
CVE-2026-18459 is a high-severity vulnerability in RTI Connext Professional Core Libraries involving incorrect calculation that allows abuse of existing functionality. It affects multiple versions ranging from 4.1x up to but not including 7.7.0.1. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk without requiring user interaction or privileges. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
CVE-2026-18458 is a medium severity vulnerability in RTI Connext Professional Core Libraries involving out-of-bounds read, incorrect function call arguments, and type confusion. It affects versions 6.1.2.21, 7.3.0 up to but not including 7.3.1.6, and 7.4.0 up to but not including 7.7.0.1. The flaw allows overreading buffers, potentially leading to unauthorized data access or application instability.
CVE-2026-18457 is a heap-based buffer overflow vulnerability in RTI Connext Professional Core Libraries. It affects multiple versions ranging from 5.2.3 up to but not including 7.7.0.1. The vulnerability allows buffer overflow conditions that could be exploited to impact the integrity and availability of the affected software. The CVSS 4.0 base score is 8.3, indicating a high severity issue with network attack vector and no user interaction required.
CVE-2026-11389 is a medium severity vulnerability in RTI Connext Professional Core Libraries that involves an out-of-bounds read due to function calls with incorrect argument counts and type confusion. It affects versions from 7.4.0 up to but not including 7.7.0.1, and from 7.3.0 up to but not including 7.3.1.6. This vulnerability can cause buffer overread conditions.
CVE-2026-11388 is a double free vulnerability in RTI Connext Professional Core Libraries that allows file manipulation. It affects versions from 7.4.0 up to but not including 7.7.0.1, and from 7.1.0 up to but not including 7.3.1.6. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No known exploits in the wild or vendor patches are currently documented.
Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1.
Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.3x before 5.1.*.
CVE-2026-84388 is a critical information disclosure vulnerability in Fortinet FortiPAM Chrome Extension versions 7.4 (all versions) and 8.0 (all versions). The flaw arises from improper restriction of rendered UI layers or frames, which may allow a remote unauthenticated attacker to disclose sensitive information. An official fix is available for this vulnerability.
virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin` visit, as token generation is deferred to `admin_init` via `register_settings()`.