GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.
A stored cross-site scripting (XSS) vulnerability exists in Palo Alto Networks PAN-OS software, allowing a malicious authenticated administrator to store or execute JavaScript payloads via the web interface. This issue affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted. The risk is reduced when management interfaces are restricted to trusted internal IP addresses as per Palo Alto Networks' best practices. No patch information is provided, and no known exploits are reported in the wild.
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster.
CVE-2026-73334 is a high-severity vulnerability in Apache Parquet Hadoop versions 1.12 through 1.18. It involves improper input validation in the org.apache.parquet.crypto.keytools package, which handles encryption of Parquet files using envelope encryption with a Key Management Service (KMS). The vulnerability arises when the KMS URL parameter is controlled by the file rather than the application, potentially allowing a malicious file to direct KMS tokens to an attacker-controlled host. Users are advised to enforce application control over the KMS URL parameter until the issue is fixed in a future release (presumably version 1.19), which will disable file-controlled KMS URLs by default and require explicit validation and authentication if enabled.
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
A UI misrepresentation vulnerability exists in Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to use social engineering techniques to spoof UI elements by crafting malicious HTML pages. The vulnerability is classified with medium severity by Chromium security. No CVSS score or exploit in the wild is currently reported.
A type confusion vulnerability in the V8 JavaScript engine of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to read memory inside the sandbox by delivering a crafted HTML page. This vulnerability is rated high severity by the Chromium security team. No CVSS score or patch information is currently available.
Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Permission control vulnerability in the event notification module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 9.6 Extended Update Support. The update fixes several security issues including use-after-free (UAF), out-of-bounds reads, heap overflow, and invalid input validation in various kernel subsystems such as rxrpc, smb client, io_uring, zram, USB serial, iscsi, i2c, and posix-cpu-timers. The advisory also includes bug fixes and enhancements unrelated to security. The kernel update is rated as Important by Red Hat Product Security and requires a system reboot to apply.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Kernel: Privilege escalation via uninitialized data in vmci transport packet (CVE-2025-38403)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
* kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)
* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
* kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
* kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
* kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
Bug Fix(es) and Enhancement(s):
* smb: client: use actual path when queryfs (JIRA:RHEL-145425)
* RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.4.z] (JIRA:RHEL-244408)
* kernel warning : kernel/softirq.c:306 do_softirq_post_smp_call_flush+0x29/0x60 when system is booted with nosmt [rhel-9.4.z] (JIRA:RHEL-80300)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A clickjacking vulnerability affecting the Downloads feature in Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to spoof UI elements via a crafted HTML page, leveraging social engineering. The vulnerability has a medium severity rating.
CVE-2026-81792 is an Incorrect Privilege Assignment vulnerability in the MultiVendorX Product Catalog Enquiry plugin for WooCommerce. It allows privilege escalation due to improper access control. The issue affects all versions from initial release up to 6.1.5 inclusive. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or vendor advisory is provided in the input data.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
* kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
* kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
Bug Fix(es) and Enhancement(s):
* Memory leak in metadata_dst leading to OOM [rhel-10.0.z] (JIRA:RHEL-125758)
* Kernel panic in cached_dir_offload_close [rhel-10.0.z] (JIRA:RHEL-128580)
* RHEL10.0 - s390/pci: Fix __pcilg_mio_inuser() inline assembly [rhel-10.0.z] (JIRA:RHEL-161485)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of scripts. Successful exploitation could result in a low impact on the confidentiality, integrity, and availability of the application.
A critical vulnerability (CVE-2026-76578) was found in FreeIPA where the self-managed OTP token Access Control Instruction (ACI) does not require authentication and does not restrict attribute additions. This flaw allows an unauthenticated LDAP client to create an arbitrary Kerberos principal and add it to the administrators group, gaining administrative privileges remotely. The issue is compounded by a related flaw in the underlying directory server's ACI evaluation. Red Hat has issued a security advisory with a patch to fix this vulnerability.
A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
SourceCodester Online Voting System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=login endpoint. The vulnerability arises from improper handling of the Username argument, allowing remote attackers to manipulate SQL queries. This flaw has been publicly disclosed but no known exploits are reported in the wild. The vulnerability has a CVSS 3.1 base score of 7.3, indicating a medium severity level.