WPGraphQL Smart Cache versions before 2.3.3 have a vulnerability that allows unauthenticated attackers to cause uncontrolled resource consumption. This occurs via the Automatic Persisted Query handler, enabling attackers to persist unlimited query documents. By sending distinct queries with matching SHA-256 queryId values, including batched operations, attackers can cause unbounded growth of the wp_posts database table, leading to degraded database performance.
CVE-2026-104067 is an out-of-bounds memory access vulnerability in Scribus versions before 1.6.7. It occurs in the importsvm plugin when it fails to verify that bitmap and transparency mask dimensions match. An attacker can craft a malicious SVM file with mismatched mask dimensions to trigger heap reads and writes, potentially causing application crashes or arbitrary code execution under the user's privileges.
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.
Scribus versions before 1.6.7 have an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin. This flaw arises from using an unvalidated y offset to select image scanlines when importing crafted DRW files. Exploitation can lead to heap corruption, causing application crashes or potential code execution.
Scribus versions before 1.6.7 have an integer overflow vulnerability in the TIFF loader component. This flaw allows attackers to craft TIFF files with large tile dimensions that trigger a heap overflow when imported, potentially leading to application crashes or arbitrary code execution.
CVE-2026-104063 is an out-of-bounds read vulnerability in Scribus versions before 1.6.7. It affects the Mac PICT image loader and import plugin when decoding planar pixel data. A crafted PICT file with manipulated dimensions can cause heap over-reads, potentially leading to application crashes or disclosure of heap memory.
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.
CVE-2026-104061 is a heap out-of-bounds write vulnerability in Scribus versions before 1.6.7. It occurs in the scimgdataloader_psd loader due to unchecked PSD file values used as array indexes. An attacker can exploit this by convincing a user to open or import a crafted PSD file, leading to heap corruption, application crashes, and potentially arbitrary code execution with user privileges.
CVE-2026-119369 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It affects versions from initial releases up to 6.18.2. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 6.18.3.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
CVE-2026-116407 is a missing authorization vulnerability in Webba Plugins Webba Booking up to version 6.5.4. It allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure or modification. The issue is fixed in version 6.5.5.
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
CVE-2026-46499 is an authorization vulnerability in Collabora Online before versions 24.04.18 and 25.04.11. It allows read-only users to bypass the read-only restriction by sending crafted WebSocket messages to execute document-modifying commands. Although these unauthorized changes cannot be saved directly by the attacker and are discarded when the session ends, they can mislead other collaborators or be saved unknowingly by authorized editors sharing the session. This issue has been fixed in the specified versions.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.
This vulnerability was patched on 11 September 2026, and no customer action is needed.
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.
joserfc versions prior to 1.7.6 have a vulnerability in their compact JWS size guard. The library allocates attacker-controlled segments by splitting the input bytes before validating their size, causing an additional large memory allocation before rejecting oversized inputs. This can lead to increased memory usage and potential denial of service due to memory exhaustion. A fix is available in version 1.7.6 that adds size checks before splitting the input.