Multiple critical security vulnerabilities have been identified in Apache Tomcat affecting versions from early milestones through recent releases up to 11.0.26, 10.1.60, and 9.0.122. These include authentication bypass via JNDI realm misconfiguration, HTTP/2 request/response mix-ups, failure to securely enforce FIPS mode, execution after redirect, local unauthorized access via TOCTOU race condition, and incomplete cleanup causing data leakage and TLS 1.3 connection failures. Users are strongly recommended to upgrade to fixed versions 11.0.27, 10.1.61, or 9.0.123 to mitigate these issues.
A buffer under-read vulnerability in Apache Tomcat's AJP connector can cause the response body to be split between consecutive requests on the same connection. This may lead to failure of the second request and potential leakage of data from the first response to the second. The issue affects Apache Tomcat versions from 11.0.0 through 11.0.26 and is fixed in version 11.0.27.
Apache Tomcat contains a vulnerability in HTTP/2 asynchronous servlet processing where incorrect object recycling and reuse can cause request and response mix-ups between users. This affects versions 9.0.118 through 9.0.122, 10.1.55 through 10.1.60, and 11.0.22 through 11.0.26. The issue is fixed in versions 9.0.123, 10.1.61, and 11.0.27. Users should upgrade to these fixed versions to mitigate the risk.
Pillow versions from 11.0.0 up to but not including 13.0.0 contain a vulnerability in multi-frame image loaders where stale native image storage is reused after mode transitions. This can cause out-of-bounds writes and crashes, and in some cases, native over-reads leading to potential command execution. The issue is fixed in version 13.0.0.
A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1 to mitigate this issue.
CVE-2026-114358 is a critical SQL Injection vulnerability in the Radius Xenia M2M Platform. It arises from insufficient validation of user input in the password recovery functionality of the web management interface. An unauthenticated remote attacker can exploit this flaw by injecting crafted SQL queries. Successful exploitation may lead to unauthorized access to sensitive data, database structure enumeration, or modification of database records.
Apache CouchDB versions 3.5.2 and earlier contain a vulnerability where an unvalidated runtime configuration value allows a CouchDB server administrator to execute arbitrary shell commands as the operating system user running CouchDB. This issue is fixed in version 3.5.3.
The Frontend Dashboard WordPress plugin before version 3.0.5 and the ProfileGrid WordPress plugin before version 6.0.0.5 contain a vulnerability that allows unauthenticated users to store serialized PHP objects in user metadata. These objects are deserialized when a public profile is viewed, enabling PHP object injection that can lead to arbitrary file write and potential remote code execution.
An authorization bypass vulnerability exists in the /nodered functionality of FUXA version 1.3.2-2809. This flaw allows an attacker to send a specially crafted unauthenticated HTTP request that can lead to arbitrary code execution on the affected system. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
The Bot for Telegram on WooCommerce plugin for WordPress versions up to and including 1.3.0 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to forge bot updates and impersonate any WordPress user by exploiting a REST endpoint that lacks proper permission checks and signature verification. Attackers can obtain a login token and gain persistent authenticated sessions without credentials, potentially taking over administrator accounts.
The Chat AI with Dispatcher WordPress plugin versions prior to 2.4 improperly validate uploaded files, relying solely on a client-supplied content type that can be spoofed. This vulnerability allows unauthenticated attackers to upload arbitrary files, including executable PHP scripts, potentially leading to remote code execution on the affected server. The issue is fixed in version 2.4.
A critical path traversal vulnerability exists in the Automated Import Products to Cart WordPress plugin before version 1.0.4. This flaw allows users with minimal permissions, such as subscribers, to read and delete arbitrary files on the server by exploiting improper sanitization of user-supplied file paths. The vulnerability can lead to exposure of sensitive data, including database credentials, and unauthorized file deletion.
A critical vulnerability in the LogixFast Auth WordPress plugin versions before 1.0.4 allows unauthenticated attackers to reset any user's password by sending the password-reset code to an attacker-supplied email address instead of the legitimate user's email. This flaw enables account takeover, including administrator accounts.