A directory traversal vulnerability exists in version 3.0 of the quilt source package unpacking process. The issue arises when the packaging tarball contains the quilt database directory (.pc) with attacker-controlled symbolic links. If patches fail to apply, the code responsible for restoring backup files may be tricked into modifying or deleting files pointed to by these malicious symlinks.
P-Net versions prior to 1.0.4 have a vulnerability where the Application Relationship of an RPC session is released improperly when a request fragment uses a different data representation (endianness) than the first fragment. This causes the application to not recognize that the Application Relationship has ended, leaving resources referencing cleared structures. An attacker with adjacent network access who has observed the connection's activity UUID, which is sent in cleartext in every RPC request, can connect in place of the original host using a single PDU.
A stored cross-site scripting (XSS) vulnerability exists in Brainstorm Force Spectra ultimate-addons-for-gutenberg versions up to 2.20.5. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges and user interaction to execute malicious scripts in the context of affected users. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability in X.Org xwayland before 24.1.15 and X Server before 21.1.26 involves incorrect handling of negative return values from the ddQueryImageAttributes() function during processing of XvPutImage requests. Authenticated X clients could exploit this flaw to cause the X server to crash, resulting in a denial of service condition.
Dell PowerStore has an information disclosure vulnerability (CVE-2026-107525) that allows an unauthenticated attacker to obtain service metadata. This metadata could be leveraged for further attacks. The vulnerability has a medium severity rating with a CVSS score of 5.3. No affected versions or patch information are provided.
P-Net versions prior to 1.0.4 contain a vulnerability where the record data length of an IODWrite request to a non-user record index is not properly checked against the size of the record block header. This can cause an underflow in length calculation, leading to fixed-size reads that may read beyond the session buffer. Exploitation requires an established Application Relationship and adjacent network access. The vulnerability has a low severity score.
CVE-2026-125815 is a cross-site scripting (XSS) vulnerability in the 'We’re Open!' opening-hours plugin by Noah Hearle. It involves improper neutralization of script-related HTML tags, allowing code injection. The vulnerability affects versions up to 2.8. The CVSS score is 5.3, indicating medium severity. No public exploits or patches are currently documented.
A Cross-Site Scripting (XSS) vulnerability exists in Rymera Web Co's Product Feed PRO for WooCommerce plugin, allowing improper neutralization of script-related HTML tags. This flaw enables code injection via crafted input. The vulnerability affects versions up to and including 13.5.8. The CVSS score is 5.3, indicating a medium severity level with network attack vector and no user interaction required.
An integer overflow vulnerability exists in the glamor Xv Image Size handling component of X.Org xwayland versions before 24.1.15 and X server versions before 21.1.26. Authenticated clients could exploit this flaw to cause the X server to crash or potentially leak data.
Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-116411) that allows an authenticated user with limited privileges to potentially cause information disclosure by making requests to internal services. The vulnerability has a high severity with a CVSS score of 8.8. No affected versions or patch information are provided.
A stored cross-site scripting (XSS) vulnerability exists in PublishPress Gutenberg Blocks up to version 3.7.6. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that can execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences.
P-Net versions before 1.0.4 have a vulnerability in how they identify RPC sessions by activity UUID only. An attacker on an adjacent network who can observe the activity UUID, which is transmitted in cleartext, can send a single PDU to abort an Application Relationship without verifying the source or context. Additionally, the system may allocate sessions for unknown activity UUIDs and alter stored session addresses.
A stored cross-site scripting (XSS) vulnerability exists in YITH WooCommerce Ajax Product Filter up to version 5.24.0. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.
P-Net versions before 1.0.4 have a vulnerability where the IP configuration from a DCP Set request is saved to both current and non-volatile configurations before verifying the device state. If the request is refused, such as when an Application Relationship is active, the configuration is not reverted and remains saved. After a restart, the device uses the refused IP address, potentially causing communication issues with the controller or address conflicts. An attacker with adjacent network access can exploit this behavior while an Application Relationship is active.
A vulnerability in PublishPress Gutenberg Blocks (advanced-gutenberg) allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. This affects versions up to and including 3.7.6. The vulnerability has a medium severity with a CVSS score of 5.3.
Dell PowerStore contains an authorization-bypass vulnerability that could allow a user with limited privileges to elevate their access to administrator level. This vulnerability is identified as CVE-2026-86356 and has a high severity rating with a CVSS score of 8.8. No specific affected versions or patches have been provided in the available data.
Dell PowerStore has a vulnerability involving the use of broken cryptography. This flaw allows a low-privileged attacker to impersonate another identity, which could lead to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.1. No specific affected versions or patches are currently documented.
A stored cross-site scripting (XSS) vulnerability exists in WProyal Royal Elementor Addons up to version 1.7.1070. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Dell PowerStore contains an insecure-file-permissions vulnerability (CVE-2026-116412) that allows a local low-privileged attacker to disclose administrative credentials. The vulnerability has a medium severity with a CVSS score of 5.5. There is no information about affected versions or available patches.
P-Net versions before 1.0.4 have a vulnerability where the alarm receiver state is set to waiting for confirmation before parsing alarm notification data. If parsing fails, the state is not restored, causing subsequent alarms of the same priority to be discarded without acknowledgment until the Application Relationship is released. This issue requires the attacker to have adjacent network access and an established Application Relationship context.