The pre-commit tool's virtualenv component improperly writes the 'prompt' value into the pyvenv.cfg configuration file without sanitizing line boundary characters. This allows an attacker controlling the prompt input to inject additional configuration lines, potentially altering critical keys such as 'home' that determine the base interpreter location. This vulnerability affects versions >=2.1.1 <2.20.0_1 and >=3.6.1 <4.6.2_1. A patch is available in versions 2.20.0_1 and 4.6.2_1 that sanitizes line boundaries by collapsing them to spaces during serialization. The vulnerability requires the prompt to be influenced by external, untrusted input, such as CI job templates or environment variables, to be exploitable.
Admidio versions 5.0.0 up to but not including 5.0.15 contain an unauthenticated stored cross-site scripting (XSS) vulnerability in the RegistrationPresenter.php component. This vulnerability occurs because the raw FIRST_NAME registration value is inserted into an unencoded data-message attribute. An attacker can exploit this by registering with a specially crafted input containing a double-quoted event handler, which executes JavaScript in an administrator's session when they hover over the entry on the Manage registrations page.
FreeRDP versions 3.0.0 up to but not including 3.32.0 contain an integer truncation vulnerability in the license_check_stream_length function. This flaw allows a malicious RDP server to send a specially crafted SERVER_LICENSE_REQUEST with a large scopeCount value that bypasses length checks. On 32-bit clients, this triggers a heap buffer overflow, potentially leading to denial of service or remote code execution.
FreeRDP versions from 3.9.0 up to but not including 3.32.0 contain an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers. This flaw occurs because the code checks value length before consuming alignment padding, allowing malicious or compromised RDP servers to send crafted unaligned RDPEAR payloads. Such payloads, including CreateApReqAuthenticatorReq messages, can cause the client process to over-read memory and potentially crash. The vulnerability affects clients using Remote Credential Guard. The CVSS score is 5.3, indicating medium severity, with no confidentiality or integrity impact but a potential denial of service via client crash. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
FreeRDP versions before 3.32.0 have a vulnerability where the server-supplied signed MS-RDPEGT geometry origin is stored unchecked in an unsigned video surface coordinate. This causes the blit clamp in gdiVideoShowSurface() to wrap in 32-bit arithmetic and be skipped. A malicious RDP server can exploit this by sending a negative topLevelLeft value to clients connecting with the /video option, leading to an out-of-bounds write of decoded H.264 picture data or a client abort.
FreeRDP versions from 3.11.0 up to but not including 3.32.1 contain a reachable assertion vulnerability in the urb_isoch_transfer function. This flaw allows a malicious RDP server to crash the client by sending a specially crafted OutputBufferSize value that exceeds INT32_MAX. The vulnerability triggers an assertion failure in libusb_udev_isoch_transfer, causing client termination. The CVSS score is 3.1, indicating low severity, with no confidentiality or integrity impact, only availability impact due to client crash.
Zebra versions before 6.4.0 have an improper integrity validation vulnerability in the inbound gossip download path. This flaw allows unauthenticated peers to cause the dropping of new blocks without penalty by serving a block with a manipulated coinbase scriptSig. This manipulation triggers a behind-tip drop before consensus validation, delaying tip discovery for mining backends. The issue is fixed in version 6.4.0.
AnyDesk versions prior to 8.0.3 contain a critical heap-based buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code as root on Linux systems without user approval. The flaw exists in the stream packet handler for mode 5 in the session protocol, where a payload length value is not properly validated.
CVE-2026-105280 is a medium severity vulnerability in hexpm hex affecting versions from 0.20.2 up to but not including 2.5.2. It involves improper validation of integrity check values when fetching packages with the command mix hex.package fetch using standard output. This flaw allows a malicious package mirror to substitute altered tarball data that is written to standard output without checksum verification, potentially leading to untrusted content being processed. The vulnerability arises because the standard output branch bypasses the checksum comparison that is otherwise enforced when writing to a file. Additionally, error responses containing tar archives can be written to standard output before checksum verification, enabling extraction of untrusted files if the output is piped to an unpacking tool.
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return value of that call was discarded and the once guard was latched to true even when the call failed. Because sys_csrand_get() leaves the destination buffer untouched on failure (it deliberately propagates the entropy-driver error rather than filling the buffer), a single failed call left unique_key as its all-zero BSS content for the remainder of the boot, with no retry, no log message and no fallback.
A failure of the cryptographic random source is required to reach the weak state — for example -ENODEV/-EIO from the entropy driver in subsys/random/random_entropy_device.c (the in-tree comment notes that the hardware RNG "might still be gathering entropy during early boot situations"), or psa_generate_random() failing in subsys/random/random_psa.c when PSA crypto is not initialised or is backed by a Bluetooth-HCI entropy device that is not yet up. The first TCP connection is what triggers key generation, so a remote peer that reaches a listening port immediately after boot, or that can provoke a reboot, has indirect influence over whether generation coincides with that window. tcp_init_isn() is called for every passive open in tcp_conn_new() and every active open in net_tcp_connect(), so the poisoned key governs all TCP connections for that boot.
With an all-zero key the ISN becomes a public function of the connection four-tuple plus a device-wide time offset. An off-path attacker can compute the hash term offline for any four-tuple and recover the shared time offset from a single observed ISN, after which the ISN the device will pick for other four-tuples is predictable. That defeats exactly the protection RFC 6528 provides: blind TCP connection spoofing against peers that trust the source address, and blind data injection into or reset of connections whose four-tuple can be guessed. Devices whose entropy source never errors were never in the weak state.
The fix moves key generation into a single guarded helper that latches only on success, logs the error otherwise, and makes tcp_init_isn() fall back to sys_rand32_get() — the behaviour already used when CONFIG_NET_TCP_ISN_RFC6528 is disabled — instead of hashing with a known-constant key.
The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F), yielding a value of 0..15. In gt911_process() that value is used directly as the loop bound for filling point_reg[], a stack array sized to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS, whose Kconfig range is 1..5 with a default of 1. No other check constrains the count; the driver relied only on a comment asserting that the controller had been programmed at init to report no more points than configured.
Each loop iteration issues an I2C read of eight bytes straight into point_reg[i], so a controller that reports more points than the array holds causes up to 112 bytes of peer-supplied data to be written past the end of the array, over the stack frame of gt911_process() in the system workqueue thread. Two further loops then read out of bounds from the same array. Triggering it requires control of, or the ability to substitute, the I2C touch controller — plausible on the many supported boards where the GT9xx panel is a pluggable display module or shield rather than an on-PCB part; a spoofed device need only answer the init probes with a supported product ID and a checksum-valid config blob. The same overflow can also occur non-adversarially, with a GT9271-class panel that ignores the driver's touch-count programming and reports up to ten points, or with bus corruption of the single status byte.
The impact is an out-of-bounds stack write with fully attacker-chosen content executing at kernel privilege, i.e. potential control-flow hijack on the host MCU, in addition to out-of-bounds reads and crashes. The attack vector is physical/local hardware access only; there is no network, USB, or syscall path to the defect. The fix clamps the reported count with min() against CONFIG_INPUT_GT911_MAX_TOUCH_POINTS before any array indexing.
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
An integer overflow vulnerability in the BSON value-length validation of the MongoDB Go Driver can lead to an application denial of service. This flaw occurs during the processing of BSON data, potentially causing the application to crash or become unresponsive.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the GET /sys/api/getUserByName endpoint. This flaw allows low-privileged authenticated users to retrieve any user's stored password value. The password data is AES-CBC encrypted, but attackers can obtain the hard-coded encryption key from another endpoint (/sys/getEncryptedString) to decrypt the passwords offline. This vulnerability can expose administrator password ciphertexts to offline guessing attacks.
CVE-2026-97853 is a memory allocation vulnerability in the ericmj decimal library affecting versions from 0.1.0 up to but not including 3.1.2. The Decimal.round/3 function allocates memory proportional to the 'places' argument before applying context precision, allowing excessive memory use. For example, calling Decimal.round with a large negative places value can allocate multiple gigabytes of memory, potentially causing denial of service by exhausting system memory and terminating the BEAM VM. This issue arises when user-supplied decimal places are not properly bounded.
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
The 10Web Booster WordPress plugin versions up to and including 2.34.8 are vulnerable to a stored cross-site scripting (XSS) flaw via the 'author' parameter. This vulnerability arises from improper input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's handling of the comment author Name value, which can bypass WordPress core sanitization and break out of an HTML attribute context.