Threats affecting pkg:generic/kimageformats

The Chargely Free Subscriptions For Woocommernce WordPress plugin version 1.0 and earlier exposes sensitive configuration data via an unauthenticated REST API route. This flaw allows attackers to retrieve the live WooCommerce REST API consumer key and secret, which provide full read and write access to the store.

The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 contain a missing authorization vulnerability. This flaw allows unauthenticated users to invoke certain AJAX actions without capability checks, enabling them to delete stored configurations and records.

The Email Marketing 4Dem WordPress plugin up to version 2.0.5 lacks proper authorization checks on multiple AJAX actions and REST API routes. This flaw allows unauthenticated users to access and disclose stored plugin configuration and data, as well as modify the plugin's stored settings.

The Countdown, Coming Soon, Maintenance WordPress plugin up to version 3.0.8 has a vulnerability where it does not verify user permissions before returning post titles via an AJAX action. This allows any authenticated user, including subscribers, to view the titles of published posts of any post type, even those normally restricted by WordPress. However, draft, private, and pending posts are not disclosed.

The Countdown, Coming Soon, Maintenance WordPress plugin up to version 3.0.8 contains a cross-site scripting (XSS) vulnerability. This occurs because the plugin does not perform authorization or nonce checks when saving countdown data on post save, and its output sanitization allowlist permits script tags. As a result, users with Author-level access or higher can inject arbitrary scripts that execute when the affected content is viewed on the front end or in an administrator session.

The Optimole WordPress plugin up to version 4.2.19 contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. Exploitation requires the presence of PEAR's Archive_Tar library and an administrator to perform a rename action on an attachment after the attacker stages a malicious payload in a comment. This can lead to remote code execution if critical files like wp-config.php are deleted.

A critical authorization bypass vulnerability exists in the AutomatorWP Pro plugin for WordPress, specifically in the webhook addon, affecting all versions up to and including 1.4.4. This flaw allows unauthenticated attackers to reset passwords of any WordPress user account, including administrators, leading to full account takeover. Exploitation requires a specific plugin configuration involving a Receive Webhook trigger paired with an Update-User action with certain fields left blank or mapped to the webhook password tag.

This entry references internally found bugs fixed in Firefox ESR 153.1 and Firefox 154, but the provided data pertains to a Microsoft vulnerability (CVE-2026-74988) with minimal details. The description does not detail the nature of the vulnerability or its impact. No patch or remediation information is provided, and no active exploitation is reported.

This entry references internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1, and Firefox 154, but the provided data pertains to a Microsoft vulnerability (CVE-2026-74987) with minimal details. The description does not detail the nature of the vulnerability or its impact. No patch or remediation information is provided.

A site isolation issue has been identified in the CSS Parsing and Computation component of Microsoft software version 4.0. The vulnerability is catalogued as CVE-2026-74986 and is associated with CWE-200, indicating an information exposure weakness. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation details are currently available.

CVE-2026-74985 is a privilege escalation vulnerability in the Enterprise Policies component of Microsoft software version 4.0. The vulnerability allows an attacker to gain elevated privileges, potentially impacting system security. No CVSS score or detailed technical information is provided. There is no indication of active exploitation in the wild or available patches at this time.

A vulnerability identified as CVE-2026-74983 affects the Data Loss Prevention component in Microsoft software version 4.0. The issue involves a mitigation bypass, classified under CWE-693. No CVSS score or detailed technical impact information is provided. There is no indication of known exploitation in the wild or available patches at this time.

A denial-of-service vulnerability has been identified in the Widget component of Microsoft software version 4.0. The vulnerability is publicly known but lacks detailed technical information and a CVSS score. No exploits are reported in the wild, and no patch or remediation details are provided.

A site isolation issue has been identified in the Audio/Video: Web Codecs component of Microsoft software version 4.0. The vulnerability is documented under CVE-2026-74981. No detailed technical information, impact, or exploit status is provided beyond its publication date.

CVE-2026-74979 is a vulnerability involving a mitigation bypass in the Add-ons Manager component of Microsoft software version 4.0. No detailed technical information or impact specifics are provided beyond this classification.

CVE-2026-8962 is a vulnerability in a Microsoft security component related to a mitigation bypass in the DOM. The vulnerability affects version 4.0 of the product. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches.

CVE-2026-8960 is a spoofing vulnerability affecting Microsoft WebExtensions version 4.0. The vulnerability is publicly known but lacks detailed technical information and a CVSS score. No exploits in the wild or patch information are currently available.

CVE-2026-92079 is a vulnerability in the Widget: Win32 component of Microsoft software version 4.0 that allows mitigation bypass. The vulnerability is identified with CWE-693. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches at this time.

CVE-2026-8959 is a vulnerability in a Microsoft Win32 component called Widget, caused by incorrect boundary conditions that could allow a sandbox escape. This means that an attacker might bypass sandbox restrictions and execute code outside the intended isolated environment. The affected version is exactly 4.0. No CVSS score or detailed impact information is provided.

A use-after-free vulnerability exists in the CPPI descriptor handling in the RX path of the ti: icssg-prueth network component. This flaw could lead to memory corruption issues. The affected version is 4.0. No CVSS score or detailed impact information is provided.