A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.
CVE-2026-116261 is a medium severity vulnerability in libimobiledevice up to version 1.4.0. It involves an out-of-bounds read in the afc_file_open function of the AFC File Handler component. The flaw arises from improper handling of the argument bytes, allowing a remote attacker to trigger the issue. Public exploit code has been disclosed, but there is no indication of exploitation in the wild. The vendor has not responded to the disclosure, and no patch information is available.
V-DAP is an experimental Rust engine designed to measure cryptographic execution timing to explore whether such measurements can provide useful diagnostic information for latency issues beyond conventional observability tools. Preliminary experiments show a correlation between cryptographic timing intervals and total request latency, but the project does not claim production readiness or proven diagnostic advantage. The research is ongoing to determine if V-DAP can distinguish causes of latency and improve diagnostic accuracy compared to existing methods.
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.
This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
CVE-2026-116260 is a double free vulnerability in the libimobiledevice library up to version 1.4.0, specifically in the service_receive function of the AFC Service component. The flaw can be triggered remotely and has publicly available exploit code. The vendor has not responded to the disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-116259 is a medium-severity memory corruption vulnerability in libimobiledevice up to version 1.4.0. It affects the afc_get_device_info_key function in the Device Info Handler component. The flaw is triggered by manipulating the argument Value, causing memory corruption. Exploit code has been publicly released, but exploitation requires local access. The vendor has not responded to the disclosure and no patch information is available.
CVE-2026-116258 is a heap-based buffer overflow vulnerability in libimobiledevice affecting versions 1.0 through 1.4.0. The flaw exists in the AFC component, specifically in the src/afc.c file. This vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure attempts. The CVSS 4.0 score is 5.3, indicating medium severity.
CVE-2026-89209 is an authentication bypass vulnerability in Siemens Mendix SAML modules for Mendix 9, 10, and 11 compatible versions prior to 3.6.29 and 4.2.4 respectively. The flaw allows unauthenticated remote attackers to replay valid SAML assertions in IdP-initiated authentication flows, potentially gaining unauthorized access to applications.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.
Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.
MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.
An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.
The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.
The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid for WordPress block editor: from n/a through 2.5.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2.
CVE-2026-116257 is a vulnerability in BillaBear version 2025.01.03 affecting the Installation Handler component. Specifically, the processInstall function in src/BillaBear/Controller/InstallController.php lacks proper authentication, allowing remote attackers to exploit this flaw without credentials. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed with available exploit information. The vendor has not responded to the disclosure, and no patch or remediation is currently documented.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.
Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.