The FlexStock plugin for WooCommerce on WordPress is vulnerable to stored Cross-Site Scripting (XSS) via the 'products[].post_content' parameter in all versions up to and including 3.17.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping, combined with exposure of the REST bearer token in the Dashboard page source without proper capability checks.
The WP Directory Kit plugin for WordPress versions up to and including 1.6.0 is vulnerable to a generic SQL Injection via the 'idfield' parameter. This vulnerability arises from insufficient escaping of user input and inadequate preparation of the SQL query, allowing unauthenticated attackers to inject additional SQL commands. The flaw can be exploited to extract sensitive information from the database without authentication.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images' parameter affecting all versions up to and including 2.8.197. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the browsers of administrators or editors when they view the pending listing's edit screen. This vulnerability enables a privilege escalation chain through normal editorial workflows.
The Ninja Forms plugin for WordPress up to version 3.15.5 is vulnerable to reflected DOM-based cross-site scripting (XSS) via a crafted 'querystring:<key>' URL parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute in the context of a victim's browser if they are tricked into clicking a malicious link.
A logic error in Epiphany browser's permission handling causes camera and microphone access to be granted when the user only approves clipboard or website data access permissions. This occurs because the code incorrectly grants audiovisual permissions when handling certain permission types, allowing a malicious site to use getUserMedia without additional prompts after clipboard or website data access is allowed. The vulnerability affects Epiphany versions 45.0 through at least 51.x and requires user interaction to exploit. A fix has been implemented upstream.
A vulnerability in json-glib's JSONPath slice evaluator can cause an infinite loop when processing slice expressions with a negative step. This flaw allows an attacker who can supply crafted JSONPath expressions to cause the application to hang, resulting in a denial of service. No confidentiality or integrity impacts have been reported. No fixed release is currently available, and all shipped Red Hat and Fedora json-glib builds with this evaluator are affected.
The WooCommerce Extra Product Options Pro plugin for WordPress up to version 3.3.2 is vulnerable to reflected cross-site scripting (XSS) via specific parameters related to Date & Time Range Picker fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link on affected product pages. Exploitation requires no prior knowledge beyond viewing the product page source to identify the vulnerable parameter names.
OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows an attacker with valid credentials for one client to obtain tokens with the privileges of another client if the application validator authorizes based on the attacker-supplied client_id argument. The issue is fixed in OAuthlib version 0.21.0_1.
VOLTA-AUTODOXER is a self-deleting Windows infostealer that uses AI to prioritize stolen victim data by monetization value. After harvesting credentials, sessions, wallets, and other sensitive data, it builds a detailed evidence bundle about the victim, enriched via stolen session access. This bundle is sent to an LLM via OpenRouter, which acts as an intelligence analyst to rank the victim's assets and assess their security posture. The malware uses a multi-model fallback approach to ensure the AI completes the assessment despite model refusals. VOLTA operates as a builder model, allowing customers to compile customized binaries with their own API keys. There is no attacker-owned infrastructure, and exfiltration occurs in multiple stages. The AI integration represents a novel approach in malware by automating victim profiling and prioritization.
pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity relative to the mantissa size, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the vulnerable RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5. Applications passing attacker-controlled ASN.1 REAL values to these decoders without proper input limits may be vulnerable to CPU exhaustion during decoding.
CVE-2026-119196 is a high-severity vulnerability in pyasn1 (up to version 0.6.4) used by smbclient-ng (>=3.1.0). It causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential denial of service via CPU exhaustion. This occurs because the decoder repeatedly shifts and copies the accumulated value for each fragment. The vulnerability affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported.
A denial of service vulnerability exists in pyasn1 versions 0.6.4 and earlier used by smbclient-ng (>=3.1.0). The flaw causes quadratic-time CPU consumption when decoding constructed OCTET STRINGs or indefinite-length ANY types composed of many fragments, leading to CPU exhaustion. This affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).
CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by smbclient-ng (>=3.1.0) where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to CPU exhaustion and reduced service availability when processing attacker-controlled inputs. The vulnerability arises from inefficient handling of tag sets during decoding, causing excessive CPU consumption without affecting confidentiality or integrity.
A denial of service vulnerability in Schemathesis's GraphQL-core validation occurs due to a memory leak when validations are aborted after exceeding the max_errors limit. The shared ValidationAbortedError instance retains traceback frames and validation context, causing memory to grow with each aborted validation request. This can exhaust memory and crash the process. The issue affects versions >=4.32.1 and <4.32.5 and is fixed in 4.32.5.
The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Because the parameter is used in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping provides no protection against time-based payloads such as SLEEP-based conditionals.