Search: 7.3.1.1

OpenBao versions 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 have an information disclosure vulnerability that exposes the tls_acme_eab_mac_key via the sanitized configuration endpoint. This key is used for ACME External Account Binding for TLS listener certificates, and its exposure allows unauthorized binding to the operator's ACME account. The issue is fixed in versions 2.6.4 and 2.7.1.

OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the AppRole authentication method where expired Secret IDs are not checked upon use. This flaw allows expired Secret IDs to remain valid until they are removed by a periodic tidy process, potentially enabling unauthorized login beyond the intended time-to-live (TTL).

OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 have a vulnerability in the rate limit quota subsystem. The flaw causes role resolution to fail for requests with form-encoded bodies or forwarded certificates, allowing quota rules scoped to backend-specific roles to be bypassed. This enables valid callers to repeatedly issue tokens without consuming their configured role-based rate limit budget.

OpenBao versions before 2.6.3 and between 2.7.0 and before 2.7.1 have an information disclosure vulnerability. Attackers can cause sensitive data to be leaked into audit logs by sending malformed plugin parameters, specifically malformed TypeKVPair or TypeHeader field values. This results in error messages containing sensitive input being recorded in audit logs.

OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 have an issue where response audit entries are not recorded for certain unauthenticated endpoints related to root token generation and rekey operations. This lack of response audit logging can hinder forensic detection of these sensitive operations.

OpenBao versions before 2.6.4 and 2.7.0 before 2.7.1 contain a vulnerability in the Kubernetes Auth method token renewal process. The software does not verify that the original Kubernetes service account token used for authentication is still valid when renewing tokens. This allows an authenticated attacker to persist access by continuously renewing tokens even after the associated Kubernetes service account has been deleted.

A vulnerability in the Link Library WordPress plugin before version 7.10.0 allows unauthenticated users to access sensitive information such as telephone numbers, email addresses, and submitter names associated with links. This occurs because the plugin does not verify that a requested link belongs to the settings set whose display template is used to render it, potentially exposing data configured to be hidden.

The Link Library WordPress plugin versions before 7.10.0 contain an authorization bypass vulnerability. This flaw allows unauthenticated users to submit links to libraries that require login by reusing a form token from a different library that does not require login. The issue is fixed in version 7.10.0.

A use-after-free vulnerability in the Linux Kernel CIFS file system allows local attackers with high-privileged code execution capabilities to escalate privileges. The vulnerability is assigned CVE-2026-72315 and has a high severity rating of 7.2 by ZDI.

A use-after-free vulnerability in the Linux Kernel XFRM subsystem allows local attackers with low-privileged code execution to escalate privileges. The vulnerability is assigned CVE-2026-98231 and has a high severity rating of 7.8 by ZDI. Exploitation requires prior local code execution capability.

A remote code execution vulnerability exists in MLflow's PickleEvaluationArtifact deserialization process. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI and is tracked as CVE-2026-118623.

A remote code execution vulnerability exists in MLflow's SHAP load_explainer functionality. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating assigned by ZDI with a CVSS score of 7.8.

A cross-site scripting (XSS) vulnerability exists in serialize-javascript versions 7.0.1 before 7.1.3 due to unescaped </script sequences in function bodies. This flaw could allow injection of malicious scripts when untrusted data is serialized and rendered in a web context.

A security flaw in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8 affects the Request Forwarder component, allowing information disclosure. The vulnerability can only be exploited from the local network. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS score is 4.3, indicating medium severity.

Mattermost versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, and 11.7.x up to 11.7.10 contain a vulnerability in the Agents plugin's mention reminder component. This flaw allows an authenticated user with posting permissions in a channel visible to a system administrator to craft a post with a forged mention reminder. If the administrator clicks this mention, their browser sends an unintended API request that can replace an installed plugin, leading to remote code execution on the server.

A server-side request forgery (SSRF) vulnerability exists in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8 within an unknown function of the Request Forwarder component. This vulnerability allows remote attackers to manipulate requests, potentially leading to unauthorized internal network interactions. Public exploit code is available. A patch identified by commit b0d3876247a0a64fa0e430e4b21870e41f503182 is recommended to fix the issue.

FreeImage (danoli3 fork) versions before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder within PluginIFF.cpp. The flaw arises due to missing bounds checks on ByteRun1 runs, allowing crafted IFF/LBM PBM files with runs crossing scanline boundaries to write up to 127 bytes beyond the allocated heap buffer. This vulnerability has a high severity rating with a CVSS score of 7.8.

xianyu-auto-reply-fix versions through 2.0.7 have a missing authorization vulnerability in the POST /send-message endpoint. This flaw allows unauthenticated attackers to send messages on behalf of other users by exploiting publicly known default API secrets. Attackers can use a hard-coded api_key along with another user's cookie_id and chosen message parameters to send arbitrary messages from that merchant account.