A PHP Object Injection vulnerability exists in the Product Catalog Feed component of PixelYourSite versions up to and including 3.1.4. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service via crafted input. The flaw is identified as CWE-502 and has a CVSS 3.1 base score of 7.2, indicating a high severity impact.
A PHP Object Injection vulnerability exists in myPOS Checkout versions up to and including 1.4.5. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service. The flaw is identified as CWE-502 and has a CVSS 3.1 score of 7.2, indicating high severity.
Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0.
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob() sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the registry bearer token, Basic credentials, or custom authentication headers. Redirect-time header stripping does not prevent the leak because the cross-host PUT is a new explicit request rather than a followed redirect. This is a residual of CVE-2026-59891, whose fix changed credential selection in credentials.ts but did not constrain where credentials are sent from registry.ts. Version 0.7.2 fixes the issue by separating registry credentials from client-wide defaults and sending them only to the registry origin.
Red Hat OpenShift Logging 6.6.2 is a cluster-wide logging solution for OpenShift that collects and manages application, infrastructure, and audit logs. A security advisory (RHSA-2026:92593) addresses multiple issues in this component, including fixes for several bugs and vulnerabilities identified by CVE-2026-41178 and others. The update includes improvements such as upgrading Loki to version 3.7.9, enabling flush on shutdown for ingesters, and adding Prometheus alerts. The advisory provides instructions for upgrading OpenShift Container Platform 4.22 and OpenShift Logging 6.6 to apply these fixes.
Crass versions prior to 1.0.7 contain a vulnerability where processing a stylesheet with a large number of adjacent CSS comments causes excessive recursion, leading to a SystemStackError. This occurs when the default behavior of discarding comments is used (i.e., :preserve_comments option is false). The issue is fixed in version 1.0.7, which eliminates recursion when discarding comments. As a workaround, enabling the :preserve_comments option prevents the recursion and the error.
SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying party defaults to allowing access when a constraining age, role, or restriction claim is absent, the silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified.
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
A missing authorization vulnerability exists in Kit Kit (formerly ConvertKit) up to version 3.4.7. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain resources or functions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.
FreeMail versions prior to 5.3.2 have an authorization bypass vulnerability that allows authenticated users to claim mailboxes belonging to other users. By exploiting the POST /api/create endpoint, an attacker who knows another user's email address can become a co-owner of that mailbox. This unauthorized access enables reading messages and verification codes, setting mail forwarding, and deleting mail. The vulnerability is tracked as CVE-2026-119049 with a high severity score of 7.6.
A missing authorization vulnerability in the WPFunnels Team Product Feed Manager plugin (best-woocommerce-feed) up to version 7.14.1 allows attackers to exploit improperly configured access control security levels. This vulnerability does not require authentication and can lead to unauthorized modification of data or settings, impacting the integrity of the system.