Blender versions before 4.5.15 and 5.x before 5.2.3 contain a heap buffer overflow vulnerability caused by an integer overflow in the ptcache_data_alloc() function when reading point cache files. An attacker can supply a crafted point cache file with a large totpoint value alongside a .blend file to cause a crash or execute arbitrary code with the user's privileges.
A missing authorization vulnerability exists in WP ManageNinja LLC Fluent CRM up to version 3.2.6. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized access or actions within the application. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.
A heap buffer overflow vulnerability exists in Blender versions before 4.5.15 and 5.x before 5.2.3. The flaw is caused by a 32-bit integer overflow in the thumb_data_vertical_flip() function used by the blend file thumbnail extractor. Maliciously crafted .blend files with specially designed TEST block dimensions can trigger out-of-bounds writes when previewed by blender-thumbnailer or the Windows shell extension, potentially leading to crashes or arbitrary code execution.
WPGraphQL versions prior to 2.24.1 have a vulnerability due to missing rate limiting on the sendPasswordResetEmail mutation. This allows unauthenticated attackers to send numerous password reset emails by aliasing the mutation in a single HTTP request, bypassing batch limits. The attack can exhaust the mail provider quota and repeatedly rotate reset keys, effectively blocking legitimate users from recovering their passwords.
pybars3 versions up to 0.9.7 have a code injection vulnerability in the pybars/_compiler.py component. This flaw allows template authors to execute arbitrary Python code by supplying crafted Handlebars templates with unescaped bracketed path segments. The vulnerability enables breaking out of string literals and running Python code within the application process.
Grimoire versions before 1.0.0 have an unauthenticated server-side request forgery (SSRF) vulnerability in the /api/fetch-metadata POST endpoint. This flaw allows attackers to submit arbitrary URLs that the server fetches and parses without authentication, potentially exposing internal or cloud metadata information. The vulnerability has a CVSS score of 5.8, indicating medium severity.
The My Calendar WordPress plugin versions 3.8.8 up to but not including 3.8.11 contain a shortcode injection vulnerability. This flaw allows unauthenticated attackers to execute registered shortcodes via the 'mcs' search parameter. The vulnerability arises because the 'mcs' parameter value is passed to the mc_search_results() function without proper bracket encoding before the do_shortcode function executes, enabling shortcode execution on any page or post. This can lead to content injection and spoofing.
Paperclip versions from 2026.403.0 up to but not including 2026.416.0 contain a remote code execution vulnerability. This flaw allows users with agent API keys to set shell commands via a PATCH request to the execution workspace API. When the workspace is archived, these commands are executed by the Paperclip server process, enabling execution of arbitrary OS commands on the host.
PipesHub versions from 0.3.0 up to but not including 0.10.0 have an event type injection vulnerability. This flaw allows authenticated users with the crawl:write scope to delete connectors by injecting malicious values into the :connector path segment. Exploitation bypasses intended permission checks, enabling deletion of connector instances and purging of record embeddings.
PipesHub versions before 0.10.0 have a server-side request forgery (SSRF) vulnerability in the ImageParser._fetch_single_url function. This flaw allows attackers to cause the indexing service to fetch internal network addresses by embedding malicious image URLs in documents. Attackers can exploit this by supplying Markdown or HTML content through uploads, synced mailboxes, or web connectors, potentially accessing loopback, private network, or cloud metadata endpoints. The fetched image responses are then embedded into the indexed content, which could lead to information disclosure.
abp-next-admin versions 10.4.0 through 10.7.0 have a cross-tenant authorization bypass vulnerability in the BlobManagement download-by-name endpoint. This flaw allows authenticated users to access files belonging to other tenants by supplying a victim tenantId in the request path, causing the system to switch tenant context improperly and return blobs stored by that tenant.
xiaozhi-esp32-server versions up to 0.9.8 have an authentication bypass vulnerability in the WebSocketServer._handle_auth function. This flaw allows remote attackers to bypass Bearer HMAC token verification by spoofing the Device-ID header with an allowlisted MAC-address-shaped identifier. Exploitation enables opening an authenticated WebSocket session, issuing voice-assistant commands, exchanging audio, and accessing the conversation context of the spoofed device.
Bastille versions through 1.4.4 have a symlink following vulnerability in the cp.sh, rcp.sh, and jcp.sh subcommands. This flaw allows jailed users to escape their jail isolation by planting symbolic links that cause administrator-run copy operations to overwrite or read host files with root privileges.
WPGraphQL versions prior to 2.24.1 have a missing authorization vulnerability in the createComment mutation. This flaw allows unauthenticated attackers to add comments to non-public posts, including drafts, private, trashed, or password-protected posts. Exploitation can lead to leaking hidden post titles via moderator notifications, enumerating post IDs, and manipulating comment metadata such as backdating or marking comments as pingbacks.
WPGraphQL Smart Cache versions prior to 2.3.3 have a vulnerability that allows unauthenticated attackers to cause uncontrolled resource consumption. Attackers can persist unlimited query documents via the Automatic Persisted Query handler, leading to unbounded growth of the wp_posts table and degraded database performance.
WPGraphQL versions before 2.24.2 have an information disclosure vulnerability that allows unauthenticated attackers to determine the existence of certain objects. By sending requests to specific mutations such as deleteMediaItem, updateMediaItem, deleteComment, and updateComment, attackers can infer the presence of hidden draft, private, trashed posts, custom post types, and unapproved comments based on distinct error responses.
A stored cross-site scripting (XSS) vulnerability exists in The Events Calendar plugin by Liquid Web / StellarWP, affecting versions up to 6.18.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute scripts in the context of other users. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.
InternLM LMDeploy versions 0.9.0 through 0.18.0 have a critical unauthenticated remote code execution vulnerability. Attackers can send specially crafted pickled data to the /update_weights endpoint, which is deserialized without validation, allowing execution of arbitrary OS commands as the api_server process.
A Cross-Site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.7.1 due to improper neutralization of script-related HTML tags. This allows an attacker to inject code into web pages generated by the affected software. The vulnerability has a medium severity rating with a CVSS score of 5.3.
SonicJS versions through 3.0.0 have a missing authorization vulnerability in certain API write routes. Authenticated users with author or editor roles can bypass document access controls and administrator restrictions to create, modify, publish, or soft-delete documents belonging to other users. This occurs because the API only checks coarse role labels rather than fine-grained permissions.