The Kirki plugin for WordPress versions prior to 6.4.1 has a broken object-level access control vulnerability in its page REST API. This flaw allows users with Kirki edit access, typically granted to the Editor role, to modify titles, slugs, and publication statuses of any non-trashed post, including custom post types and WooCommerce products they do not own. The vulnerability arises because the API relies only on a coarse role-based access check without verifying per-object WordPress capabilities. Exploitation can expose private or draft content or remove published content by manipulating the post_status field.
Skuul School Management System versions up to 2.6.5 contain an access control vulnerability in the ResultChecker::checkResult method. Authenticated students can manipulate the studentId parameter to access other students' examination results without authorization.
A race condition vulnerability in the Epiphany browser allows a malicious website to bypass the TLS/SSL certificate warning page. This occurs because the browser registers a script message handler for TLS errors immediately before loading the error page, creating a brief window where an attacker can exploit predictable page IDs to approve certificate exceptions without user interaction. This flaw enables man-in-the-middle or site spoofing attacks until the browser is restarted.
Dell OpenManage Enterprise versions prior to 4.8.0 have an incorrect permission assignment vulnerability that allows a low privileged local attacker to bypass protection mechanisms. This vulnerability does not require user interaction and impacts confidentiality but not integrity or availability.
Bitcoin Core versions prior to 29.5, 30.4, 31.2, and 32.1 are affected by an out-of-memory (OOM) issue. This vulnerability could cause the software to consume excessive memory, potentially leading to crashes or denial of service conditions.
CallBackery versions before 0.62.0 for Perl have a vulnerability in the session cookie signing mechanism. The signing secret is generated using the built-in rand() function seeded with 32 bits, resulting in a limited secret space of at most 2^32 values. An attacker who obtains a single signed session cookie can perform an offline brute-force attack to recover the secret and then forge session cookies for any user, including administrators.
Dell OpenManage Enterprise versions prior to 4.8.0 have a Missing Authentication for Critical Function vulnerability (CVE-2026-111500). This flaw allows an unauthenticated attacker with adjacent network access to potentially perform server-side request forgery. The vulnerability impacts integrity and availability but does not affect confidentiality. The CVSS score is 5.4, indicating a medium severity level.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an improper input validation vulnerability (CVE-2026-91917). This flaw allows a low privileged attacker with adjacent network access to potentially execute code on the affected system. The vulnerability has a high severity rating with a CVSS score of 8. No specific patch information is provided in the input data.
An improper access control vulnerability exists in ESET Endpoint Encryption and ESET Full Disk Encryption. This flaw allows an attacker with standard user permissions to access a privileged kernel driver's device interface and send specially crafted requests. The vulnerability has a high severity score of 8.5.
CallBackery versions before 0.62.0 for Perl contain a denial of service vulnerability due to unsafe interpolation of the request path as a regular expression under CGI, FastCGI, and PSGI environments. This allows an unauthenticated attacker to craft a request path with backreferences that causes exponential backtracking, potentially keeping a worker process busy for minutes.
CallBackery versions before 0.62.0 for Perl contain a vulnerability that allows OS command execution via sqlite3 shell commands embedded in a restored configuration backup. The restoreConfigBlob() function feeds a database dump from a backup to the sqlite3 command-line shell, which executes lines starting with a dot as shell commands. This enables an attacker who can supply a backup to execute arbitrary commands with the application's user privileges.
Business::GoCardless versions before 1.01 for Perl have a vulnerability where redirect flows are completed without verifying the session token. This allows an attacker who obtains another customer's redirect flow ID to create payments or subscriptions against that customer's mandate.
CallBackery versions before 0.62.0 for Perl expose users to information disclosure by sending them their own password hash and an admin-only note via the getUserConfig function. Non-administrative users can access sensitive notes intended only for administrators, and attackers with a session token can obtain password hashes to attempt offline cracking.
OpenManage Enterprise versions prior to 4.8.0 contain an improper resource locking vulnerability (CVE-2026-111498). This flaw could allow a high privileged local attacker to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 4.7. No public exploits or known active exploitation have been reported. A fix is available starting from version 4.8.0.
CallBackery versions before 0.62.0 for Perl are vulnerable to log injection via newlines in the login name. The login() function writes the login name to application logs without escaping control characters, allowing an unauthenticated attacker to forge log records, including fake administrator login entries.
Business::GoCardless versions before 1.01 for Perl contain a vulnerability that allows remote attackers to exhaust memory by sending specially crafted legacy webhook payloads. The flaw arises because the software flattens the payload into key-value pairs before verifying the webhook signature, leading to memory exhaustion proportional to the payload size. This can be triggered with a single request carrying no valid signature.
CallBackery versions prior to 0.62.0 for Perl contain a vulnerability in the createRxValidator function where form field validation patterns are improperly constructed. This allows authenticated users to submit values that should be rejected by the intended pattern checks. Such values may then be written into generated configuration files, potentially leading to security issues related to configuration integrity.
CallBackery versions prior to 0.62.0 for Perl use a weak method to encrypt configuration backups by deriving the AES key directly from the backup password padded with 'x' characters and truncated to 32 bytes, without salt or key derivation. This allows an attacker who obtains a backup to perform fast offline password guessing at raw AES speed, potentially recovering all credentials stored in the backup.
CallBackery versions prior to 0.62.0 for Perl store user passwords using unsalted HMAC-SHA1 hashes without a key, resulting in identical hashes for identical passwords and no computational delay to slow guessing attacks. This weak password hashing approach allows an attacker who gains access to the user table to efficiently perform offline password guessing.
DateTime::Lite versions before 0.8.1 for Perl contain a vulnerability where adding a large number of seconds to a date-time object with a non-floating time zone causes a CPU exhaustion condition. This occurs because the _normalize_leap_seconds function processes time additions one day at a time without limiting the number of iterations, allowing an attacker to keep the process busy indefinitely.