Forge (node-forge) versions prior to 1.4.0 contain a vulnerability in the RSASSA PKCS#1 v1.5 signature verification process. The flaw allows attackers to forge signatures by inserting extra data within the ASN structure and by exploiting insufficient padding validation, enabling Bleichenbacher-style signature forgeries. This compromises the integrity and authenticity of communications relying on these signatures. Version 1.4.0 addresses this issue.
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. This has been fixed in 5.73.16 and 6.7.2.
GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches the issue.
CVE-2026-4982 is a high-severity vulnerability in pretix Venueless that allows a user with the "update world" permission to exfiltrate chat messages from direct messages or channels in other worlds on the same server. This occurs due to improper input validation in the reporting feature. Exploitation requires knowledge of the internal channel UUID, which limits the attacker's ability to exploit this from outside the system.
HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks such as XSS, SQL Injection, Command Injection etc.
CVE-2026-33285 is a high-severity vulnerability in the LiquidJS template engine prior to version 10.25.1. The issue involves improper input validation allowing the memoryLimit security mechanism to be bypassed using reverse range expressions. This can lead to unlimited memory allocation and a subsequent V8 fatal error that crashes the Node.js process, causing a denial of service. The vulnerability is patched in LiquidJS version 10.25.1.
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
CVE-2026-33332 is a medium-severity vulnerability in the Python-based UI framework NiceGUI versions prior to 3.9.0. It involves improper input validation of a user-controlled query parameter in the app.add_media_file() and app.add_media_files() routes. This parameter affects how files are read during streaming, allowing attackers to bypass chunked streaming and force the server to load entire media files into memory simultaneously. Exploiting this can cause excessive memory consumption, degraded performance, or denial of service, especially with large files and concurrent requests. No authentication or user interaction is required to exploit this vulnerability. The issue has been patched in NiceGUI version 3.
CVE-2026-33769 is a low-severity vulnerability in the Astro web framework versions 2.10.10 up to but not including 5.18.1. It involves improper input validation in the remotePatterns path enforcement used by server-side fetchers like the image optimization endpoint. The flaw arises because the path matching logic for /* wildcards is unanchored, allowing attackers to craft pathnames that bypass intended allowlist prefixes and fetch resources outside the allowed scope on permitted hosts. This can lead to unauthorized data retrieval from the server. The vulnerability requires no authentication or user interaction and has not been observed exploited in the wild. It was patched in Astro version 5.
A moderate severity vulnerability (CVE-2025-0938) was identified in the Python 3 URL parser used in Red Hat Enterprise Linux 8 and 9. The flaw allowed square brackets in domain names, which is non-standard behavior. Red Hat has issued security advisories with updated packages to address this issue. The vulnerability affects multiple Python 3 versions distributed with Red Hat Enterprise Linux across various architectures. No known exploits in the wild have been reported. The vendor has provided official fixes through updated packages.
Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.
CVE-2025-15606 is a high-severity Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 router. It arises from improper input validation (CWE-20), allowing an attacker to send crafted HTTP requests that cause the httpd service to crash, resulting in service interruption. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to availability. The CVSS 4.0 score is 7.1, reflecting its high impact and ease of exploitation. Organizations relying on this router model may experience network outages or degraded service. Mitigation involves applying vendor patches once available, restricting access to the device's management interface, and monitoring for unusual HTTP traffic patterns.
The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2. This is due to the permission callback (update_user_wechatshop_info_permissions_check) only validating that the supplied 'openid' parameter corresponds to an existing WordPress user, while the callback function (update_user_wechatshop_info) uses a separate, attacker-controlled 'userid' parameter to determine which user's metadata gets modified, with no verification that the 'openid' and 'userid' belong to the same user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary users' store-related metadata (storeinfo, storeappid, storename) via the 'userid' REST API parameter.
The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a public REST API webhook endpoint at /webhook-system without implementing webhook signature validation, secret verification, or any mechanism to authenticate that incoming webhook requests genuinely originate from the legitimate Appmax payment service. The plugin directly processes untrusted attacker-controlled input from the 'event' and 'data' parameters without verifying the webhook's authenticity. This makes it possible for unauthenticated attackers to craft malicious webhook payloads that can modify the status of existing WooCommerce orders (e.g., changing them to processing, refunded, cancelled, or pending), create entirely new WooCommerce orders with arbitrary data, create new WooCommerce products with attacker-controlled names/descriptions/prices, and write arbitrary values to order post metadata by spoofing legitimate webhook events.
Socket.IO versions prior to 3.3.5, 3.4.4, and 4.2.6 contain an improper input validation vulnerability. A specially crafted packet can cause the server to buffer a large number of binary attachments, potentially exhausting server memory. This vulnerability has been patched in the specified versions.
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability that chains three flaws: a missing permission check on the Excel upload API allowing any authenticated user to upload malicious terminology, unsanitized storage of terminology descriptions containing dangerous payloads, and a lack of semantic fencing when injecting terminology into the LLM's system prompt. Together, these flaws allow an attacker to hijack the LLM's reasoning to generate malicious PostgreSQL commands (e.g., COPY ... TO PROGRAM), ultimately achieving Remote Code Execution on the database or application server with postgres user privileges. The issue is fixed in v1.6.0.