CVE-2026-115964 is a critical SQL Injection vulnerability in StylemixThemes Motors plugin for WordPress, affecting versions before 1.4.127. It allows an unauthenticated attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and partial availability impact. A fix is available in version 1.4.127.
Apache Qpid Proton C versions up to 0.40.0 contain an authentication bypass vulnerability due to improper handling of SASL frames during peer authentication. This flaw allows AMQP frames masquerading as SASL frames to bypass authentication, potentially granting unauthorized access. The impact depends on how the application handles the absence of a username, as authentication is considered incomplete in such cases. The issue is fixed in version 0.41.1.
CVE-2026-105042 is a critical vulnerability in Apache Qpid Proton C (versions up to 0.40.0) where deeply nested message bodies decoded by pn_message_body() can cause uncontrolled recursion leading to stack overflow and crash. The issue is fixed in version 0.41.1.
CVE-2026-105031 is a critical vulnerability in Apache Qpid Proton C up to version 0.40.0 involving improper certificate validation when using the OpenSSL TLS implementation. The affected APIs add to rather than replace the default system trust anchors, potentially causing the application to trust unexpected peer certificates. This issue does not affect the Win32 SChannel TLS implementation. The vulnerability is fixed in version 0.41.1.
Two memory-safety vulnerabilities in the PHP runtime bundled with Welotec's SMART EMS product up to version 3.5.3 allow unauthenticated remote attackers to execute arbitrary code in the PHP web worker context. Exploitability depends on server interface, configuration, application behavior, and worker reuse. Public exploit code is available.
Red Hat has released a critical security and bug fix update for Red Hat Advanced Cluster Security (RHACS) version 4.10.11. This update addresses multiple issues, including vulnerabilities identified by CVE-2026-103314 and CVE-2026-114406. Users of earlier RHACS versions are advised to upgrade to 4.10.11 to benefit from the security patches and enhancements. The advisory references release notes for detailed information on the fixes and improvements included in this release.
CVE-2026-114358 is a critical SQL injection vulnerability in the Radius Xenia M2M Platform's password recovery functionality. It arises from insufficient validation of user-supplied input in the web management interface. An unauthenticated remote attacker can exploit this flaw by submitting crafted SQL queries, potentially gaining unauthorized access to sensitive data, enumerating the database structure, or modifying database records.
A critical integer overflow vulnerability exists in GitLab CE/EE versions from 7.0 up to certain patched releases before 18.11.13 and 19.x series before specific patch versions. This flaw could allow an unauthenticated attacker to execute arbitrary code on the GitLab server by exploiting an integer overflow during the compilation of a specially crafted regular expression.
A critical buffer overflow vulnerability exists in the Brotli decoder used by python-brotlicffi versions prior to 1.1.0.0-2.oe2403sp4. This flaw allows a remote unauthenticated attacker to corrupt memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Users should update to fixed versions 1.1.0.0-2.oe2403sp4 or later to mitigate the risk.
CVE-2025-40233 is a critical vulnerability in the Linux kernel affecting the ocfs2 filesystem and the DSA network subsystem. The ocfs2 flaw involves stale extent map cache after extent moves or defragmentation, causing a kernel BUG_ON due to mismatched extent flags. The DSA issue relates to improper reference counting of conduit network devices, potentially leading to stale pointers and resource management errors. The vulnerability is fixed in Linux kernel version 5.10.0-339.0.0.240.oe2203sp4.
Multiple critical security vulnerabilities have been identified in Apache Tomcat versions ranging from early milestone releases through recent stable versions up to 11.0.26, 10.1.60, and 9.0.122. These include authentication bypass, request/response mix-up in HTTP/2 asynchronous servlets, failure to securely enforce FIPS mode, execution after redirect, local unauthorized access via a TOCTOU race condition in unix domain sockets, and incomplete cleanup issues causing information leaks and TLS 1.3 connection failures. Users are strongly recommended to upgrade to fixed versions 11.0.27, 10.1.61, or 9.0.123 to address these vulnerabilities.