The @sylphx/pdf-reader-mcp package, when run as an HTTP server with MCP_TRANSPORT=http, fails to enforce API key authentication despite logging that it does. This allows unauthenticated access to the /mcp endpoint, enabling any client able to reach the server to invoke PDF processing tools and read any accessible PDF files on the host. The default binding to all interfaces (0.0.0.0) increases exposure risk. This vulnerability affects versions >=2.2.0 and <3.0.1 and is fixed in version 3.0.1.
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.
CVE-2026-119124 is a heap-based buffer overflow vulnerability in ImageMagick versions before 7.1.2-34. The flaw occurs in the -morph processing feature, where specially crafted images can cause writes beyond the bounds of a heap buffer. This can lead to heap memory corruption and application crashes when processing such images.
ImageMagick versions before 7.1.2-34 contain a stack overflow vulnerability in the TIFF decoder that can be triggered when the DNG decoder is disabled. An attacker can supply a crafted image file to cause uncontrolled recursion, leading to a stack overflow and application crash, resulting in denial of service.
CVE-2026-115794 is a low-severity vulnerability in RT-Labs P-Net versions before 1.0.3. It involves improper handling of a length parameter in the application alarm callback, where the data length derived from a received alarm frame is not validated against the actual frame length. This can cause the callback to receive an excessively large length value, potentially leading to out-of-bounds reads if the application copies that many bytes. Exploitation requires an established Application Relationship and adjacent network access. Applications that do not use the alarm data are not affected. The issue is fixed in version 1.0.3.
CVE-2026-111736 is a high-severity vulnerability in RT-Labs P-Net before version 1.0.3. It involves a NULL pointer dereference in the function pf_fspm_cm_read_ind() when processing an implicit read request lacking a valid target AR UUID for a user-specific record index, provided the application has registered a read callback. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the affected device.
CVE-2026-111734 is an out-of-bounds read vulnerability in RT-Labs P-Net before version 1.0.3. The vulnerability arises because the function pf_eth_recv() does not properly validate the length of received Ethernet frames before reading fields such as EtherType, VLAN tags, and PROFINET FrameID. Specifically, the VLAN tag processing loop lacks an upper bound, which can cause the function to read beyond the end of the receive buffer when processing truncated frames or frames composed solely of VLAN tags. This can lead to a denial of service via a crash or unintended disclosure of memory contents.
CVE-2026-111733 is a high-severity vulnerability in RT-Labs P-Net versions before 1.0.3. It involves a NULL pointer dereference triggered by handling an implicit read request without a valid target AR UUID for certain record indices. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the device. The issue is fixed in version 1.0.3.
CVE-2026-112256 is a critical vulnerability in OpenText Advanced Authentication Server that allows acceptance of extraneous untrusted data alongside trusted data. This flaw leads to accessing functionality not properly constrained by access control lists (ACLs), potentially enabling unauthorized actions. The vulnerability affects versions from 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0. Fixed versions are 6.4.3.9, 6.5.0.11, and 6.6.2.0. The CVSS 4.0 score is 9.2, indicating a critical severity level.
A Missing Authorization vulnerability (CWE-862) exists in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons up to version 3.4.2. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact with low confidentiality impact and no integrity or availability impact.
A missing authorization vulnerability exists in the miniOrange Page Restriction WordPress plugin up to version 1.6.1. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.
A missing authorization vulnerability exists in Kit Kit (formerly ConvertKit) up to version 3.4.7. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain resources or functions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.
A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetElements For Elementor up to version 2.9.2.6. This flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.
A missing authorization vulnerability in the weDevs WP ERP plugin (up to version 1.17.10) allows exploitation of incorrectly configured access control security levels. This flaw could permit users with limited privileges to access certain functionality or data without proper authorization. The vulnerability has a CVSS score of 4.3, indicating a medium severity impact primarily affecting confidentiality. No public exploits or patches are currently documented.
A stored cross-site scripting (XSS) vulnerability exists in weDevs Happy Addons for Elementor up to version 3.50.1. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences. No patch or fix information is currently provided.
A missing authorization vulnerability exists in WP Desk Custom Price for WooCommerce (custom-price-for-woocommerce) versions up to 1.1.29. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modifications. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A missing authorization vulnerability in Brainstorm Force SureDash (up to version 1.12.3) allows exploitation due to incorrectly configured access control security levels. This flaw permits unauthorized access to certain functionality or data without proper permission checks.
A stored cross-site scripting (XSS) vulnerability exists in PublishPress Authors up to version 4.17.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
CVE-2026-112255 is a vulnerability in OpenText Advanced Authentication Server versions 6.4.0.0 through 6.6.1.0 involving insecure default initialization of a resource. The issue allows excessive allocation due to insecure configuration that permits creation or recreation of Unauthenticated Endpoints without proper network restrictions. The vulnerability is addressed in version 6.6.2.0 by enforcing secure configuration practices, specifically disallowing unauthenticated endpoint creation or restricting it to trusted networks via a non-empty whitelist.
A Missing Authorization vulnerability (CWE-862) exists in Magepeople inc.'s Taxi Booking Manager for WooCommerce (ecab-taxi-booking-manager) up to version 2.1.6. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data or functionality. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), indicating limited impact on confidentiality but potential integrity issues. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.