CVE-2026-124540 is a vulnerability in JSON::XS for Perl before version 4.05 that allows stack exhaustion via uncontrolled recursion when decoding nested tagged values with allow_tags enabled. This leads to an uncatchable segmentation fault caused by C stack exhaustion regardless of the max_depth setting.
CVE-2026-124539 is a memory leak vulnerability in JSON::XS for Perl versions before 4.05. The flaw occurs when decoding an object with a missing colon after a key, causing the decoded key scalar to not be freed. This results in a memory leak where each rejected document retains one key in memory, potentially exhausting process memory over time.
CVE-2026-124536 is a vulnerability in JSON::XS for Perl versions before 4.05 that allows memory exhaustion. The flaw arises because the incremental parser buffers input beyond the configured max_size limit when a NUL byte is present, leading to unbounded memory growth. This can cause the process to exhaust available memory when processing crafted input streams.
CVE-2026-129251 is a cross-site scripting (XSS) vulnerability in hrshadhin CloudSchool versions 3.0.0 and 3.0.1. The flaw exists in the Event Description Handler component within the file app/Http/Controllers/Backend/EventController.php. An attacker can remotely exploit this vulnerability by manipulating input data, potentially leading to XSS attacks. Public exploit code is available, but there is no vendor response or patch provided as of the publication date.
CVE-2026-129250 is a critical buffer overflow vulnerability in the Edimax BR6478ACV2 router, version 1.23. The flaw exists in the formPPTPSetup function within the webs file, where improper handling of the pptpUserName argument allows remote attackers to trigger a buffer overflow. Public exploit code has been disclosed, but no vendor response or patch is currently available.
CVE-2026-129427 is a stored cross-site scripting (XSS) vulnerability in CervantesSec cervantes version v1.3-beta. It involves an attacker uploading a malicious avatar that exploits an authentication bypass in the /Attachments endpoint, leading to account takeover (ATO) by executing arbitrary code in another user's browser with elevated privileges.
Apple has detailed its Secure Exclaves architecture designed to isolate camera and microphone data used for ambient sensing from the main operating system on devices such as HomeView and new iPhones. This architecture ensures that sensitive sensor data cannot be accessed or altered by the main OS or apps, with only limited metadata shared under strict conditions. Secure Exclaves run on a formally verified microkernel to enhance security and prevent kernel compromise. The design includes user-visible indicators for sensor activity that the main OS cannot interfere with, enhancing privacy and security.
A numeric range comparison vulnerability exists in Akaunting versions 3.0 through 3.3.0 in the function calculation_to_quantity within helpers.php related to Invoice Item Validation. This flaw allows remote attackers to manipulate the quantity argument without a minimum check, potentially leading to incorrect validation outcomes. The vendor has not responded to the disclosure. The CVSS 4.0 score rates this as a medium severity issue.
CVE-2026-129247 is a path traversal vulnerability in yangzongzhuan RuoYi versions 4.8.0 through 4.8.3. The flaw exists in the VelocityUtils.getFileName function within the Code Generator component. An attacker can remotely manipulate the className argument to perform path traversal, potentially accessing unauthorized files.
The PyPI package 'xrfdc' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The Flatsome WordPress theme up to version 3.20.12 is vulnerable to stored cross-site scripting (XSS) via insufficient sanitization of certain HTML attributes ('data-text-sec', 'data-title', and 'title') in custom HTML blocks. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because WordPress's wp_kses_post function allows global data-* attributes, enabling attacker-controlled values to persist and be interpreted as executable HTML by specific JavaScript behaviors in the theme.
The Duplicate Post WordPress plugin before version 1.5.8 contains an authorization flaw where it does not verify if a user duplicating a post has permission to edit that post. When the slug takeover option is enabled, this allows users with roles granted access by an administrator, such as Contributor, to move any readable post off its original permalink and publish their duplicate at that address.
The SEOJuice WordPress plugin versions before 2.12.0 have a vulnerability where the REST API authentication filter is not properly restricted. This flaw disables WordPress's REST nonce protection site-wide, allowing unauthenticated attackers to perform any cookie-authenticated REST action. An attacker can exploit this by tricking a logged-in administrator into visiting a crafted page, enabling actions such as creating a new administrator account via CSRF.
The Duplicate Post WordPress plugin versions before 1.5.8 lack a proper capability check when saving global settings. Instead, they rely solely on their own role-access list, which can be manipulated by users with any role granted access by an administrator, including low-privilege roles such as Subscriber. This flaw allows such users to overwrite global settings, including the role-access list itself.
The Lightbox with PhotoSwipe WordPress plugin versions prior to 5.19.0 contain a vulnerability where link titles and other caption sources are not properly sanitized before being inserted as HTML into image lightbox captions. This flaw allows unauthenticated users to inject stored cross-site scripting (XSS) payloads via comments.
The Flatsome WordPress theme versions prior to 3.20.13 contain a vulnerability where the theme does not enforce user role restrictions on an AJAX save action. This flaw allows users with the Contributor role to publish their own content and change its post type, such as converting a post into a product, without having the necessary permissions.
The Flatsome WordPress theme versions prior to 3.20.13 contain a vulnerability where an AJAX action accessible to unauthenticated users lacks capability and nonce checks. This flaw allows unauthorized users to retrieve content from unpublished posts, including drafts and pending posts, by specifying post IDs.
The WP Ultimate CSV Importer and WP Ultimate CSV Importer Pro WordPress plugins before versions 9.2 and 9.0.7 respectively, expose exported post files via a publicly accessible location with predictable filenames. This allows unauthenticated attackers to download content and custom fields of any exported post, including non-public content.
The Chargely Free Subscriptions For Woocommerce WordPress plugin up to version 1.0 has a vulnerability where it does not perform authorization checks on a REST API route that exposes its stored configuration. This flaw allows unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret, which provide full read and write access to the entire store.
The Checkout Files Upload for WooCommerce WordPress plugin versions before 2.4.1 contains a vulnerability where it does not properly verify that uploaded files at checkout are allowed image types. This flaw allows unauthenticated users to upload HTML files disguised as images, which can execute JavaScript in the browser of a shop manager or administrator viewing the order screen. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.