Bricks Theme for WordPress versions before 2.4.1 contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint. This flaw allows anonymous attackers to read draft and unpublished page content by manipulating the popupId parameter without any status or capability checks. Attackers can use a public nonce to enumerate unpublished posts and disclose confidential content.
Red Hat has released a security advisory for a kernel live patch module targeting kernel version 5.14.0-284.134.1.el9_2. The update addresses multiple vulnerabilities in the Linux kernel components including netfilter, pppoe, bridge, packet, and xfrm subsystems. These vulnerabilities involve issues such as improper memory writes, pointer reload errors, and validation flaws. The advisory rates the security impact as Important and provides patches for Red Hat Enterprise Linux 9.2 variants.
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
CVE-2026-119194 is a high-severity vulnerability in the pyasn1 Python library affecting versions from 0.3.3 up to but not including 0.6.5. The flaw involves inefficient algorithmic complexity in schemaless container decoding, where attacker-controlled ASN.1 input with many distinct long tag IDs causes hash collisions. This results in quadratic CPU usage during decoding, potentially exhausting CPU resources and reducing service availability. The issue is fixed in version 0.6.5.
A vulnerability in digitalbazaar forge (node-forge) prior to version 1.4.1 allows crafted DER input with nested BIT STRINGs to cause excessive recursion and resource consumption during ASN.1 decoding. This leads to high CPU usage and quadratic memory consumption, potentially resulting in denial of service. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows improper enforcement of the path length constraint in X.509 CA certificates when the keyUsage extension is missing. This can enable an attacker with control of a path-length-constrained CA private key or a subordinate CA certificate to create a certificate chain that exceeds the declared path length yet still passes verification. The issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows a remote peer to trigger an uncaught TypeError during TLS handshake processing. This occurs when a TLS record of a different content type interrupts a fragmented handshake message, causing the process to fail and potentially disrupting the connection or hosting process. The issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows a remote attacker to cause a denial of service via uncontrolled recursion during TLS record processing. The recursive processing of TLS records consumes one JavaScript stack frame per record, enabling exhaustion of the call stack when thousands of small records are sent together. This issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar forge prior to version 1.4.1 allows bypassing password-based integrity checks in PKCS#12 processing due to acceptance of zero or negative iteration counts. This leads to predictable encryption keys and IVs in certain PKCS#12 password-based encryption schemes, compromising integrity verification. The issue is fixed in version 1.4.1.
CVE-2026-118781 is a low severity vulnerability in the digitalbazaar forge library prior to version 1.4.1. The issue is an infinite loop triggered by the BigInteger.prototype.modInverse() function when it receives a negative value or modulus during RSA key generation or direct calls. This can cause the Node.js event loop to block at full CPU usage. The vulnerability cannot be triggered by parsed DER, PEM, JWK, PKCS#12, X.509, or TLS values as they are unsigned. The issue is fixed in forge version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 involves improper certificate validation. The issue occurs during the verification of certificate chains when certificates share a subject name, causing the CA store to be modified incorrectly. This can lead to the permanent removal of trusted CA certificates from the store, resulting in persistent availability issues for applications that reuse the store. The vulnerability is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
A NULL pointer dereference vulnerability exists in digitalbazaar's forge library prior to version 1.4.1. The TLS client incorrectly checks the server certificate presence, leading to a crash when a malicious server omits the Certificate message. This results in an uncaught exception that terminates the connection or process. The issue is fixed in version 1.4.1.
A prototype pollution vulnerability exists in digitalbazaar forge versions prior to 1.4.1. The forge.http client improperly stores cookie names and paths from Set-Cookie headers in plain JavaScript objects, allowing a malicious server to manipulate Object.prototype properties via specially crafted cookie names such as __proto__ or constructor. This can lead to modification or deletion of inherited properties. The issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge library (prior to version 1.4.1) involves improper input validation of PKCS#7 padding during CBC and ECB mode decryption. The library only validated the final byte of padding and accepted malformed padding, which could lead to silent removal of up to four plaintext blocks. This causes an integrity failure in applications relying on successful decryption as proof of valid padding. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.
A cryptographic signature verification flaw exists in digitalbazaar's forge library versions prior to 1.4.1. The vulnerability involves improper verification of the signature scheme, where the library incorrectly uses the issuer certificate's RSA padding and RSASSA-PSS parameters instead of those from the child certificate. This could allow a child certificate labeled as RSASSA-PSS to be accepted with a PKCS#1 v1.5 signature if the issuer uses PKCS#1 v1.5. The flaw does not allow certificate identity forgery but may bypass policies enforcing specific signature schemes. The issue is resolved in version 1.4.1.
OpenBMB XAgent version 1.0.0 contains a directory traversal vulnerability in the main-upload_file function located in ToolServer/ToolServerNode/main.py at line 46. This vulnerability could allow an attacker to access files outside the intended directory structure.