CVE-2026-103877 is a critical deserialization of untrusted data vulnerability in Apache Directory LDAP API versions from 2.1.0 up to but not including 2.1.9. A malicious or compromised LDAP server, or a man-in-the-middle before TLS encryption, can respond to a client's loadSchema() subschema search with a specially crafted schema object containing a serialized Java class. This can lead to remote code execution (RCE). The issue is fixed in version 2.1.9.
The Relevanssi – A Better Search WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.28.3. This vulnerability arises from insufficient input sanitization and output escaping of comment content. Exploitation requires the administrator to have configured a non-empty "Allowable tags in excerpts" setting with tags that prefix the injected tag name. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages.
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges.
This issue was fixed in version 10.08.0.
CVE-2026-102243 is a command injection vulnerability in MODSetter SurfSense versions 2.0.0 through 2.0.3. It affects the MCP Connector Integration component, specifically the /api/search-source/connectors/mcp/test endpoint. The flaw allows remote attackers to execute arbitrary commands. Public exploit code is available, but no vendor response or patch has been provided.
An unauthenticated SQL injection vulnerability exists in the Joomla Extension Vehicle Manager (Free) versions prior to 6.5.8. The vulnerability arises because the order_field and order_direction parameters are used in an unquoted ORDER BY clause after escaping, which does not prevent injection. This affects three frontend entry points: category listing, search, and all-vehicles listing. The flaw allows remote attackers to execute arbitrary SQL commands without authentication.
A SQL injection vulnerability exists in SoftNews Media Group DataLife Engine 18.0 within the Search Module's strip_data function. This vulnerability allows remote attackers to manipulate the 'story' argument to execute unauthorized SQL commands. The vulnerability has a CVSS score of 7.3, indicating a medium severity level. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available. Exploit code is publicly available, but no known exploitation in the wild has been reported.
IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
CVE-2026-84724 is an argument-injection vulnerability in the Red Hat Ansible Automation Platform automation-controller system-job subsystem. It arises because a user-supplied 'days' variable is not properly validated and is flattened into a command argument string, allowing injection of additional arguments. This flaw affects system jobs executed in-process on the control node without container isolation. An authenticated user with superuser privileges can inject arbitrary arguments into the awx-manage process, controlling its argument vector and module search path. Full remote code execution is not confirmed due to the absence of a required import gadget in current management commands.
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.
Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.
A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
CVE-2026-54916 is a high-severity vulnerability in the netbox-community devicetype-library, a collection of community-sourced device type definitions for NetBox. The issue arises from Python import path manipulation during test collection, allowing an unauthenticated contributor to add malicious modules that shadow legitimate ones. This enables arbitrary code execution on GitHub Actions runners, potentially leading to test-result tampering and unauthorized access to tokens or network resources. The vulnerability is fixed by a specific commit that addresses the import path handling.
CVE-2026-11822 is a vulnerability in SQLite's FTS5 full-text search extension that allows memory corruption through out-of-bounds read and heap buffer overflow. This can be triggered by processing a specially crafted SQLite database containing malformed FTS5 page data. Exploitation may cause process crashes, memory exhaustion, or arbitrary code execution. The vulnerability affects applications that handle untrusted SQLite databases using FTS5. Red Hat AI Inference Server 3.3.7 (Spyre) includes this vulnerable component. No fix is currently available that meets Red Hat's criteria for deployment and stability.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H).