A vulnerability exists in OpenSSL's low-level CRYPTO_ocb128_encrypt() and CRYPTO_ocb128_decrypt() functions when called with non-block-aligned lengths on hardware-accelerated builds. This flaw can expose the trailing 1-15 bytes of a message in cleartext, bypassing authentication and allowing potential data disclosure or tampering. However, typical OpenSSL usage via higher-level EVP APIs, TLS protocols, and FIPS modules are not affected. Red Hat rates the impact as low for its products, and no fix is currently available that meets their criteria.
CVE-2026-111497 is a high-severity vulnerability in the Google Brotli decoder used in Red Hat AI Base Images and other Red Hat products. It involves an out-of-bounds write triggered by a crafted Brotli-compressed stream, potentially leading to memory disclosure, denial of service, or arbitrary code execution when decompressing untrusted Brotli data. Exploitation requires processing attacker-controlled Brotli data, such as HTTP content with Content-Encoding: br or APIs like Node.js zlib/fetch(). Red Hat platform hardenings increase exploitation difficulty but do not eliminate all impact. No fixes are currently available for Red Hat AI Base Images 3.4.7 (ROCm 6.4).
Red Hat AI Base Images 3.4.7 (Spyre) are referenced in a security advisory that includes multiple CVEs, notably CVE-2026-111497, which involves an out-of-bounds write vulnerability in the Google Brotli decoder. This flaw can be triggered by crafted Brotli-compressed streams during decompression, potentially leading to memory disclosure, denial of service, or arbitrary code execution. Red Hat rates this issue as Important with high severity but not critical due to attack complexity and platform mitigations. No fixes are currently available for the Red Hat AI Base Images 3.4.7 (Spyre) as per the advisory. The advisory covers related Red Hat products including OpenShift AI. The vulnerability requires decompression of attacker-controlled Brotli data to be exploited.
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
A vulnerability in RESTEasy's default exception mapper causes it to return the localized message of unhandled exceptions (other than WebApplicationException) in HTTP 500 responses. This can leak potentially sensitive information to remote unauthenticated attackers who can trigger such exceptions. The issue was confirmed in RESTEasy version 7.0.2.Final.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin versions up to and including 6.5.7 contain a stored cross-site scripting (XSS) vulnerability via the 'hierarchy[].name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, combined with an authentication mechanism that relies solely on a user meta token without proper capability checks. This token is exposed on admin pages due to a commented-out guard, increasing the risk of exploitation.
The AI Alt Text Generator plugin for WordPress up to version 2.7.0 contains an authorization bypass vulnerability. This flaw allows an attacker with a Contributor-level account to modify alt text and optionally other metadata of attachments owned by other users without proper authorization checks. Exploitation requires retrieving a nonce from certain WordPress pages and depends on specific plugin options being enabled for overwriting additional fields.
The Easy Digital Downloads WordPress plugin contains an authentication bypass vulnerability in all versions up to 3.7.2. This flaw allows an attacker to impersonate an administrator by initiating a PayPal guest checkout using the administrator's email address. The plugin trusts the email entered during guest checkout as proof of identity, leading to an authenticated session being issued for that administrator account. This results in a full administrator account takeover.
The WPML Multilingual & Multicurrency for WooCommerce plugin for WordPress has a SQL Injection vulnerability in versions up to and including 5.5.7. The flaw exists in the save_currency() AJAX handler, which does not properly validate input or check user capabilities. This allows authenticated users with Shop Manager-level access or higher to inject malicious SQL payloads via the currency exchange rate parameter, potentially extracting sensitive database information.
CVE-2026-118776 is a vulnerability in Microsoft product version 3.0 involving incomplete PKCS#7 padding validation during AES/DES CBC and ECB decryption. This flaw relates to improper input validation (CWE-20) in cryptographic operations.
SQLite versions before 3.54.0 built with the session extension have a heap buffer overflow vulnerability in the sqlite3changeset_apply() function. This flaw allows attackers to corrupt heap memory by providing specially crafted changesets that cause sessionUpdateFind() to write beyond allocated memory. The vulnerability has a high severity rating with a CVSS score of 7.8.
CVE-2026-71450 is an authentication bypass vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller products. The flaw allows bypassing authentication by using an alternate path or channel. It affects EasyIO Neo EC versions from 3.3b62 through 3.3b63 and CW Edge Controller versions from 3.3b24 through 3.3b25. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7.
PyMuPDF versions from 1.25.3 up to but not including 2.0 contain a stack-based buffer overflow vulnerability in the JM_set_annot_callout_line() function. This flaw arises when the function copies a caller-supplied number of callout points into a fixed-size three-element stack array without proper bounds checking. An attacker controlling the callout argument passed to Page.add_freetext_annot() can supply four or more points, leading to stack frame overwrite, which may cause a crash or enable code execution. The vulnerability is rated high severity with a CVSS score of 7.7. It is fixed in PyMuPDF version 2.0.