The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.
The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address.
The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.
The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.
This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Firefox and Thunderbird, including denial of service, mitigation bypasses, spoofing, privilege escalation, use-after-free, information disclosure, sandbox escapes, race conditions, integer overflows, and incorrect boundary conditions across various components such as XML, DOM, JavaScript engine, networking, graphics, and storage. The update is rated as important by Red Hat and provides fixes for these issues in Red Hat Enterprise Linux 8.4 variants. The advisory includes a comprehensive list of CVEs affecting Firefox and Thunderbird components, emphasizing the critical nature of these vulnerabilities.
A security vulnerability in GNU Aspell allows arbitrary code execution via a crafted dictionary file. This flaw affects Red Hat Enterprise Linux 9.6 Extended Update Support versions of the aspell package. Red Hat has issued an important security update to address this issue.
CVE-2026-101107 is an OS command injection vulnerability in SoftBank Corp.'s Air Terminal 6. It allows a user with access to the web management console to execute arbitrary commands with root privileges. The vulnerability affects versions from 0 up to and including 1.01.80. It has a high severity with a CVSS score of 8.0, indicating significant impact on confidentiality, integrity, and availability.
The npm package '@rfewqa-fes/mnm-doc-mcp' version 1.0.0 declares a dependency on 'node-health-utils' via an off-registry HTTP tarball URL hosted at a bare IP address. This setup allows the host controlling that IP to execute arbitrary code on any system installing the package, as the tarball is fetched without version pinning, integrity verification, or encryption. The main package itself is inert, but the dependency serves as a delivery mechanism for malicious code.
This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 9.8. The update includes fixes for several security issues such as use-after-free vulnerabilities, denial of service via unvalidated tasks in iSCSI, and privilege requirements for certain network operations. The advisory also includes various bug fixes and enhancements to improve kernel stability and security. Systems must be rebooted after applying the update for changes to take effect.
Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
The memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS).
Relative path traversal vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.
Red Hat has issued a security advisory for util-linux packages addressing three vulnerabilities: a heap use-after-free in libblkid nested partition probing (CVE-2026-13595), a time-of-check to time-of-use (TOCTOU) race condition in the mount program via ancestor directory swap (CVE-2026-53613), and an integer overflow in the DOS partition parser leading to partition metadata compromise (CVE-2026-53615). These vulnerabilities affect low-level system utilities critical for Linux system functionality. The update is rated as Important by Red Hat Product Security and applies to Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. A fix is available through updated packages provided by Red Hat.
A security vulnerability in Vim (Vi IMproved) allows arbitrary code execution due to a Vimscript injection via an unescaped filename in the netrw s:NetrwMarkFile() filter() expression. This issue is tracked as CVE-2026-43961 and affects Red Hat Enterprise Linux 9.8 Extended Update Support versions. Red Hat has released an update addressing this vulnerability along with other bug fixes and enhancements.
Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.
UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.
CVE-2026-76954 is a critical vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. It involves improper neutralization of special elements in SQL commands within the Auth API, allowing remote attackers to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-85101 is an authentication bypass vulnerability in the rsync component of Synology DiskStation Manager (DSM) versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to bypass authentication using an alternate path or channel, enabling them to read specific files, write arbitrary files, and perform limited denial-of-service attacks.
A denial of service vulnerability exists in the Qt software toolkit's QXmlStreamReader component due to crafted XML parsing. This issue is identified as CVE-2026-16762 and affects the qt5-qtbase packages used in Red Hat Enterprise Linux 9.8 Extended Update Support. The vulnerability allows an attacker to cause a denial of service condition by exploiting the XML parsing functionality.