The Confection WordPress Cable plugin versions 0.4.0 through 0.4.7 lack capability and nonce checks when saving settings, allowing unauthenticated users to write arbitrary PHP code to a file that the plugin serves. This enables remote code execution on the server without authentication.
The JWT Auth WordPress plugin versions through 3.0.2 have a vulnerability where previously issued refresh tokens are not invalidated when a user changes or resets their password or removes a connected device. This allows an attacker who obtained a refresh token before such an event to continue issuing valid access tokens and maintain authenticated access to the affected account, including accounts with Administrator privileges.
Apache Airflow's CLI audit logging masks secrets based on argument position, but some command argument patterns leave secrets exposed in cleartext within audit logs. This affects commands such as Variable commands with trailing --description, --conn-extra, and inline --password in airflow keycloak-auth-manager commands. Users with read access to audit logs but without Variable or Connection permissions can retrieve sensitive secrets via the event-log API. Users are advised to upgrade to version 3.4.0 or later and to purge old audit log entries containing exposed secrets and rotate those secrets.
Apache Airflow's public Import Errors API exposes raw parse-failure stack traces to any user with the ImportError.can_read permission when the failing file has no registered DAG. This can reveal sensitive information such as file paths and code to unauthorized users. The issue is addressed in Apache Airflow 3.4.0 and later by restricting stack trace visibility to users with the new IMPORT_ERRORS_ALL permission.
A stored cross-site scripting (XSS) vulnerability exists in StylemixThemes Motors plugin up to version 1.4.128. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The CVSS score is 6.5, indicating a medium severity impact with partial confidentiality, integrity, and availability loss.
Nimbus in Apache Storm instantiates a class specified by a topology's scheduler strategy configuration. The intended allowlist to restrict which classes can be instantiated was unset by default, effectively allowing any class on the Nimbus classpath with a no-argument constructor to be instantiated. This allows an authenticated submitter to cause Nimbus to instantiate classes with side effects, such as starting additional ZooKeeper servers or local clusters, leading to resource exhaustion in the Nimbus daemon. The issue is fixed in Apache Storm 3.1.0 by changing the default behavior to only allow built-in strategies when the allowlist is unset. Clusters using out-of-tree scheduler strategies must explicitly whitelist those classes or face rejection of the topologies.
Apache Airflow versions with multi-team deployments and secret cache enabled have a vulnerability where secret cache keys are constructed using unescaped underscore delimiters from team names and secret IDs. This can cause key collisions allowing a DAG author to access another team's Variable or Connection values. The issue affects deployments with both core.multi_team = True and secrets.use_cache = True. Upgrading to Apache Airflow 3.4.0 or later or disabling the secret cache mitigates the issue.
CVE-2026-124587 is a medium severity information disclosure vulnerability in elizaOS eliza 2.0.3-beta.7 affecting an unknown function in the HTTP Server component. The flaw allows remote attackers to obtain sensitive information. Public exploit code is available. A patch identified by commit cf6fa193017e70884e01c5bb7890f74b6b2b79d2 exists and should be applied to remediate the issue.
A code injection vulnerability exists in huggingface finetrainers versions 0.1.0 and 0.2.0 within the resolve_component_cls function of finetrainers/utils/model.py. This flaw allows remote attackers to manipulate the Library argument to execute arbitrary code. The vulnerability has a CVSS score of 6.3 (medium severity) and public exploit code is available. The project has been notified but has not issued a response or patch yet.
Apache Airflow's audit logs stored secret values from Connections and Variables in cleartext within the Log.extra column. This occurred because the secrets masker only matched configured sensitive key names, failing to mask all secret values. An authenticated user with low privileges and read access to the audit API could retrieve these secrets without prior access to the underlying resources. The issue is fixed in Apache Airflow version 3.4.0, which masks secret values properly and restricts audit log access to authorized users.
Tencent RapidJSON version 1.1.0 contains a vulnerability in the GetCachedPowerByIndex function within include/rapidjson/internal/diyfp.h. The flaw involves manipulation of the decimalPosition argument, leading to an out-of-bounds read. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The project has been notified but has not yet issued a response or patch.
A reflected Cross-site Scripting (XSS) vulnerability exists in the Review Schema software up to version 3.1.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of a user's browser session.
The DefaultStateSerializer component in Apache Storm, used for persisting and restoring stateful bolt checkpoints with a Redis-backed state provider, improperly configures Kryo serialization to allow deserialization of untrusted data without class registration. This enables an attacker with write access to the state store keyspace to inject serialized objects that execute arbitrary code in the worker JVM during state restoration. The vulnerability requires Redis-backed state usage and write privileges to the state store, which is a data-plane privilege distinct from code execution rights. Apache Storm 3.1.0 addresses this by enforcing class registration in the serializer, but upgrading may require migration due to changes in checkpoint restoration behavior.
A vulnerability in myCred up to version 4.0.2 allows unauthorized retrieval of embedded sensitive system information. This exposure can lead to a high-impact confidentiality breach without requiring user interaction or privileges.
A stored Cross-Site Scripting (XSS) vulnerability exists in the profile editing form of the website https://www.luxorgymtarrega.com. The parameters cliNom and cliCognoms do not validate or escape user input before storing it in the database and displaying it in HTML responses. This allows attackers to inject and execute arbitrary JavaScript code in the browsers of users who view the affected content.
Apache Airflow versions prior to 3.4.0 are vulnerable to unsafe deserialization in deadline alert fields. This vulnerability allows a DAG author to instantiate classes from Airflow's deserialization allow list with controlled arguments in the scheduler and API server processes. The issue persists despite a partial fix for CVE-2026-45360, which only addressed the 'reference' field, leaving 'callback' and 'interval' fields exploitable. Users are advised to upgrade to version 3.4.0 or later to mitigate this risk.
A path traversal weakness exists in the load_state_dict_into_model function of the MoE Shard Checkpoint Loader component in lxtGH OMG-Seg up to commit f3b26b609bae919760cd3ccf09c36179bb8624a0. The vulnerability arises from manipulation of the weight_map argument and can be exploited remotely. Public exploit code is available. The project does not use versioning, and no fix or response from the maintainers has been reported.
Apache Airflow's CeleryExecutor component allowed execution of callback workloads without validating authentication tokens. This flaw enables an attacker with write access to the Celery broker to enqueue forged callbacks that execute arbitrary code on all CeleryExecutor workers without needing Airflow credentials. The issue affects deployments using the CeleryExecutor. A fix is available in Apache Airflow version 3.4.0 and later, where token validation is enforced before executing callbacks.
A Cross-site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.8. This vulnerability allows improper neutralization of input during web page generation, leading to DOM-based XSS. The flaw could allow an attacker to execute arbitrary scripts in the context of the affected web application.
A stored cross-site scripting (XSS) vulnerability exists in 10Web Form Maker versions up to 1.15.50. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in the context of other users. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. It impacts confidentiality, integrity, and availability with low to high impact levels. No patch or remediation information is currently provided.