The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spawns /app/sh_for_telnet
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.
CVE-2026-69806 is a high-severity vulnerability in Microsoft .NET 10.0 that allows exposure of sensitive information to unauthorized actors. This flaw enables an authorized local attacker to elevate privileges. The vulnerability affects multiple versions of .NET including 9.0.x, 10.0.x, 11.0.0, 17.14.x, and 18.9.x. An official fix is available from Microsoft.
CVE-2026-67369 is an out-of-bounds read vulnerability in Microsoft SQL Server 2025 (CU8) that allows an authorized attacker to disclose information over a network. The vulnerability affects specific builds of version 17.0.0.0 and later but before certain build numbers. It has a CVSS 3.1 base score of 6.5, indicating a medium severity. An official fix is available from Microsoft.
CVE-2026-58649 is an origin validation error vulnerability in Microsoft .NET 10.0 that allows unauthorized attackers to disclose information over a network. The vulnerability affects multiple versions of .NET, including 8.0.0, 9.0.0, 10.0.0, 11.0.0, and specific ranges in 17.x and 18.x versions. It has a CVSS 3.1 base score of 6.5, indicating medium severity. An official fix is available from Microsoft.
CVE-2026-69805 is a high severity vulnerability in Microsoft Visual Studio 2022 version 17.14 involving external control of file name or path in .NET. This flaw allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a CVSS score of 7.5 and has been officially fixed by Microsoft. No known exploits are currently in the wild.
CVE-2026-69439 is a heap-based buffer overflow vulnerability in Microsoft .NET 10.0 and related versions. It allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects multiple versions of .NET including 8.0.x, 9.0.x, 10.0.x, 11.0.0, 17.14.x, and 18.9.x. A fix has been officially released by Microsoft.
CVE-2026-67641 is an integer overflow or wraparound vulnerability in Microsoft SQL Server 2022 (CU 26) that allows an authorized attacker to cause a denial of service over a network. The vulnerability affects specific versions prior to certain build numbers in both 16.x and 17.x branches. The issue has a medium severity rating with a CVSS score of 6.5. An official fix is available from Microsoft.
CVE-2026-67389 is an out-of-bounds read vulnerability in Microsoft SQL Server 2022 (CU 26) that allows an authorized attacker to disclose information over a network. The vulnerability affects multiple specific builds of SQL Server 2022 versions 16.0 and 17.0 prior to certain fixed builds. It has a CVSS 3.1 base score of 6.5, indicating a medium severity level. An official fix is available from Microsoft.
A cryptomining botnet compromised 3,562 Redis servers by exploiting unauthenticated Redis instances using rogue replication to inject cron jobs that deployed XMRig miners. The affected Redis versions range from 2.8.17 to 7.2.0 across various Linux distributions, indicating misconfiguration rather than a software vulnerability. The attacker toolkit, exposed via an open directory, contained exploit source code, campaign logs, and Windows registry hives. Additional attack vectors targeting WordPress, MongoDB, and SSH were included but did not result in confirmed compromises. The operation mined Monero using a wallet linked to the operator's own systems. Meterpreter deployment capabilities were also observed, extending the operator's activity timeline. No known exploits in the wild or vendor patches are documented.
Multiple vulnerabilities have been fixed in GeoNetwork, an open-source catalog application maintained by OpenGeo. The affected versions include 4.4.5 through 4.4.11 and versions prior to 4.4.12 and 4.2.17. The vulnerabilities correspond to CWE-79 (Cross-site Scripting), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), and CWE-862 (Missing Authorization). No CVSS score is provided, and no known exploits in the wild have been reported.
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.
PX4 Autopilot versions up to 1.17.0 contain a null pointer dereference vulnerability in the param_set_default_file() and param_set_backup_file() functions. This flaw can be triggered by invoking 'param select' or 'param select-backup' commands without a path argument from any PX4 shell, causing the autopilot process to crash. The vulnerability has a high severity score of 7.1 and does not require privileges or user interaction to exploit.
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.
In the Linux kernel, the following vulnerability has been resolved:
tls: device: fix out-of-bounds write in tls_append_frag()
Found with syzkaller and a local syzbot instance running on top of a
netdevsim TLS offload emulation; tls_device.c is otherwise only reachable
on a machine with a NIC that implements the offload.
tls_push_data() only checks whether the open record still has room for
another frag at the bottom of its loop, and the MSG_MORE early break
skips that check. The record survives to the next syscall with the frag
count it already had, and tls_append_frag() does not check either, so
with TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds
a non-coalescing pipe page and num_frags walks off the end of
tls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed,
tls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and
the sg_set_page() writes land on the destruct_work that follows it, which
the workqueue then calls.
The byte limit is fine because copy drops to 0 and the loop falls through
to the same check; the frag count has no such feedback.
Push the record rather than keep a full one open, which is what a plain
TCP socket does - tcp_sendmsg_locked() uses tcp_mark_push() and
new_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw
already sets full_record when the sk_msg ring fills up, MSG_MORE or not.
BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net/tls/tls_device.c:269)
Write of size 8 at addr ffff8881104d1530 by task tls_oob/450
CPU: 2 UID: 0 PID: 450 Comm: tls_oob Not tainted 7.2.0-rc7+ #329 PREEMPT
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
tls_append_frag (net/tls/tls_device.c:269)
tls_push_data (net/tls/tls_device.c:518)
tls_device_sendmsg (net/tls/tls_device.c:583)
inet_sendmsg (net/ipv4/af_inet.c:865)
sock_sendmsg (net/socket.c:775 net/socket.c:790 net/socket.c:813)
splice_to_socket (fs/splice.c:884)
do_splice (fs/splice.c:936 fs/splice.c:1349)
__do_splice (fs/splice.c:1431)
__x64_sys_splice (fs/splice.c:1634 fs/splice.c:1616)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
</TASK>
and, once the record is pushed:
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:300:24
index 18 is out of range for type 'skb_frag_t [17]'
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:301:41
index 18 is out of range for type 'scatterlist [17]'
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:302:39
index 18 is out of range for type 'scatterlist [17]'
UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:307:38
index 26 is out of range for type 'scatterlist [17]'
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle page fault for address: ffffea000411a680
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0011) - permissions violation
Oops: Oops: 0011 [#1] SMP KASAN PTI
Workqueue: ktls_device_destruct 0xffffea000411a680
RIP: 0010:0xffffea000411a680
Call Trace:
<TASK>
worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
</TASK>