A reflected Cross-site Scripting (XSS) vulnerability exists in PluginUs.Net TableOn posts-table-filterable component. This vulnerability affects versions up to and including 1.0.7. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected application.
A missing authorization vulnerability exists in the GEO my WordPress plugin (geo-my-wp) up to version 4.5.5.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable conditions without user interaction and resulting in high confidentiality impact but no integrity or availability impact.
CVE-2026-111418 is a server-side request forgery (SSRF) vulnerability in Foxit's official website HTML-to-PDF conversion service. The vulnerability arises because the service supports ZIP-formatted input, which can bypass restrictions on requests to internal IP addresses. This may allow an attacker to discover internal network resources. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity. No known exploits or patches are currently documented.
The Media Library Assistant plugin for WordPress versions up to and including 3.42 is vulnerable to reflected cross-site scripting (XSS) via the 'search-string' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a publicly accessible page with an [mla_gallery] shortcode configured with pagination output mode and an mla_link_href template reflecting a {+request:...+} token, plus enough attachments to trigger pagination. The CVSS score is 4.7, indicating medium severity.
Wasmtime versions 47.0.0 through 48.0.7, 49.0.0 through 49.0.4, and 50.0.0 are affected by a vulnerability where typed functions with i31 or nullref arguments may panic due to insufficient type-checking. This issue has a low severity impact and does not affect confidentiality or integrity but may cause a denial of service through application panic. Fixed versions are 48.0.8, 49.0.5, and 50.0.1.
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9.
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component.
This issue affects Apache Camel: from 4.21.0 before 4.22.2.
WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of string prefixes that named the IPv6 unique local range fc00::/7, while a host reached through a name was resolved and the resulting address classified with the InetAddress predicates isLoopbackAddress, isAnyLocalAddress, isLinkLocalAddress and isSiteLocalAddress. Those predicates do not cover the same ground as the prefix list: isSiteLocalAddress reports the deprecated fec0::/10 block and not the fc00::/7 unique local addresses that replaced it, and the JDK carries no predicate for them at all. The same address was therefore accepted or rejected depending on how it was written, and a webhook URL whose host name resolved into fc00::/7 passed a guard that refused the identical address given as a literal. PushNotificationDispatcher then sent the push notification to that address, together with any Authorization header carried in the same configuration, whose scheme and credentials the registering caller supplies. The webhook URL arrives as TaskPushNotificationConfig.url from the caller registering the push notification, so it is attacker-controlled, and allowLocalWebhookUrls is false by default, which is the configuration in which the guard is expected to hold. The response is not relayed back to the caller who registered the configuration, so what the gap yields is a blind outbound HTTPS request from the Camel process to an internal address the guard was written to refuse; reaching a service that way additionally requires that the name resolve into fc00::/7 in the target environment, that an HTTPS service be listening on that address, and that the TLS handshake succeed for the name being requested, which is why the severity is assessed medium. The same string pre-check was also wrong in the other direction: it matched the raw host string without first establishing that the host was an IP literal, so any name merely beginning with fc or fd, such as fcm.googleapis.com, was refused outright.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. The 4.21.x release line reached end of life before this issue was resolved and will not receive a fix, so deployments on it must move to a supported release. Both the literal and the resolved path now classify the address from its raw bytes with one shared classifier, which recognises fc00::/7 and the shared address space 100.64.0.0/10, as well as IPv4-compatible, NAT64 (64:ff9b::/96) and 6to4 (2002::/16) addresses whose embedded IPv4 address is not globally routable. For deployments that cannot upgrade immediately, place authentication in front of the A2A push notification configuration path so that the webhook URL does not arrive from an untrusted caller, and deny egress from the Camel process to fc00::/7 at the network level; where the deployment has no need of IPv6, starting the JVM with -Djava.net.preferIPv4Stack=true removes the address class the gap turns on. Note that allowLocalWebhookUrls=false is already the default and does not by itself close the gap.
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.
A critical integer overflow vulnerability exists in GitLab CE/EE versions from 7.0 up to certain patched releases before 18.11.13 and 19.x series before specific patch versions. This flaw could allow an unauthenticated attacker to execute arbitrary code on the GitLab server by exploiting an integer overflow during the compilation of a specially crafted regular expression.
PipeWire versions prior to 0.3.63-7.oe2403sp1 contain multiple unbounded alloca() calls in the PulseAudio protocol server, leading to a vulnerability (CVE-2026-14330). This flaw allows an attacker with minimal permissions inside a sandboxed environment, such as Flatpak, to escape the sandbox by exploiting PipeWire's PulseAudio compatibility layer. The attacker can load a malicious library, resulting in arbitrary code execution outside the sandbox and potential full compromise of the user's system. A fix is available in version 0.3.63-7.oe2403sp1.