iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccMpeCalculator::Read(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer overflow vulnerability exists in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary Code Execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.
The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a
configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
CVE-2025-27378 is a high-severity SQL injection vulnerability in Altium AES version 7.0.3 caused by an inactive configuration that disables the latest SQL parsing logic. This flaw allows unauthenticated remote attackers to inject and execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires no user interaction and can be exploited over the network, making it highly accessible. Although no known exploits are currently reported in the wild, the ease of exploitation and impact severity warrant immediate attention. European organizations using Altium AES 7.0.3, especially in critical infrastructure or manufacturing sectors, are at risk. Mitigation involves enabling the correct configuration to activate the updated SQL parsing logic or applying vendor patches once available.
CVE-2026-23887 is a stored Cross-Site Scripting (XSS) vulnerability in Intermesh Group-Office versions prior to 6.8.149 and between 25.0.1 and 25.0.79. It arises from unsanitized filenames stored in the database, which when viewed by users, can execute malicious scripts in their browsers. This vulnerability can lead to session hijacking or unauthorized actions within the Group-Office web interface. The issue is limited to the file-viewing context and requires user interaction to trigger.
CVE-2025-68134 is a high-severity vulnerability in the EVerest everest-core EV charging software stack prior to version 2025.10.0. It stems from improper input validation where the use of the assert function causes module crashes. When any module crashes, the manager process shuts down all other modules and exits, leading to a denial of service (DoS) that affects multiple EVSE units and users. The vulnerability does not impact confidentiality or integrity but severely impacts availability. Exploitation requires no privileges or user interaction and can be performed remotely via network access. The issue is fixed in version 2025.10.0.
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element . These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem. On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes.
Solr deployments are subject to this vulnerability if they meet the following criteria:
* Solr is running in its "standalone" mode.
* Solr's "allowPath" setting is being used to restrict file access to certain directories.
* Solr's "create core" API is exposed and accessible to untrusted users. This can happen if Solr's RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html is disabled, or if it is enabled but the "core-admin-edit" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.
Users can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores. Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.
**Summary**
A command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler.
**Root cause**
The `commitHash` variable, derived from user input via the `--commit-hash` CLI argument, is interpolated directly into a shell command using template literals (e.g., ``execSync(`git show -s --format=%B ${commitHash}`)``). Shell metacharacters are interpreted by the shell, enabling command execution.
**Impact**
This vulnerability is generally hard to exploit, as it requires `--commit-hash` to be attacker controlled. The vulnerability primarily affects CI/CD environments where `wrangler pages deploy` is used in automated pipelines and the `--commit-hash` parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
- Run any shell command.
- Exfiltrate environment variables.
- Compromise the CI runner to install backdoors or modify build artifacts.
**Mitigation**
- Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
- Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
- Users on Wrangler v2 (EOL) should upgrade to a supported major version.
**Credits**
Disclosed responsibly by kny4hacker.
Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, Swift Metrics, and Swift Distributed Tracing. Prior to Swift W3C TraceContext version 1.0.0-beta.5 and Swift OTel version 1.0.4, a denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP header. This allows crashing the process with data coming from the network when used with, for example, an HTTP server. Most common way of using Swift W3C Trace Context is through Swift OTel. Version 1.0.0-beta.5 of Swift W3C TraceContext and version 1.0.4 of Swift OTel contain a patch for this issue. As a workaround, disable either Swift OTel or the code that extracts the trace information from an incoming header (such as a `TracingMiddleware`).
OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryCreated=`. Version 0.70.0 fixes the issue.
CVE-2026-23840 is a critical cross-site scripting (XSS) vulnerability in the leepeuker movary web application, affecting versions prior to 0.70.0. The issue arises from improper input validation of the `? categoryDeleted=` parameter, allowing attackers to inject malicious scripts. Exploitation requires user interaction but no authentication, and can lead to full compromise of user confidentiality and integrity. The vulnerability has a CVSS score of 9.3, indicating a severe risk. Although no known exploits are currently in the wild, unpatched instances remain at high risk. European organizations using movary for movie tracking and rating should prioritize upgrading to version 0.
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`. Version 0.70.0 fixes the issue.
HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.
CVE-2025-61684 is a high-severity vulnerability in quicly, an IETF QUIC protocol implementation used by the h2o project. The flaw stems from improper input validation (CWE-20) that allows a remote attacker to cause an assertion failure, crashing the process and resulting in a denial-of-service (DoS) condition. This vulnerability affects all versions of quicly prior to commit d9d3df6. Exploitation requires no authentication or user interaction and can be triggered remotely over the network. While no known exploits are currently observed in the wild, the CVSS score of 7.5 reflects the ease of exploitation and significant impact on availability. The issue was fixed in commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. European organizations using h2o’s quicly implementation in their infrastructure, especially those relying on QUIC for web or application traffic, should prioritize patching to prevent potential service disruptions. Countries with high adoption of modern web infrastructure and significant internet-facing services are most at risk.
CVE-2025-29847 is a high-severity vulnerability in Apache Linkis versions 1.3.0 through 1.7.0 involving improper input validation of URL parameters in the JDBC engine and data source functionality. Multiple rounds of URL encoding can bypass system checks, enabling unauthorized access to system files via JDBC parameters without authentication or user interaction. The vulnerability impacts confidentiality but not integrity or availability. Apache has fixed the issue in version 1.8.0 by ensuring continuous URL decoding of connection information containing '%' characters.
The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.
A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.