The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
Assimp versions through 6.0.5 have an integer overflow vulnerability in the MD2Importer::ValidateHeader() function. This flaw allows attackers to craft malicious .md2 files with manipulated header fields that bypass frame table bounds checks. Exploiting this can cause heap out-of-bounds reads, potentially crashing applications or exposing adjacent heap memory.
GROWI versions 7.0.0 through 8.0.6 have a missing authorization check vulnerability in the collaborative editing feature. This flaw allows users with read-only permissions, including guest users or users with pending, suspended, or invited status, to modify page drafts. The vulnerability has a medium severity rating with a CVSS score of 5.3.
The trajmetrics package version 0.5.3 on PyPI contains malicious code that scans the entire system to exfiltrate selected file types. When used as instructed in its README, it runs a background process that continuously monitors and exfiltrates files as they change, indicating clear malicious intent as an infostealer.
Sunhillo SureLine versions prior to 9.1.5 have a path traversal vulnerability in the radarUpdater.cgi endpoint. This flaw allows unauthenticated remote attackers to read arbitrary files with root privileges by exploiting insufficient sanitization of the filename parameter. Sensitive files such as /etc/shadow, the web user database, root SSH private key, and TLS private key can be accessed, potentially leading to full system compromise.
A stored Cross-Site Scripting (XSS) vulnerability exists in the media plugin of TinyMCE. This flaw allows attackers to inject malicious scripts via elements crafted through the data-mce-object attribute, which are executed before proper sanitization. The vulnerability affects TinyMCE versions 7.9.3 and 8.5.1 up to but not including 7.9.4 and 8.9.3 respectively. It has been patched in TinyMCE 7.9.4 and 8.9.3. No official workaround is available other than upgrading.
Sunhillo SureLine versions from 8.6.0 up to but not including 9.1.5 contain an OS command injection vulnerability in the networkDiag.cgi endpoint. This flaw allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. The vulnerability arises because attackers can bypass a prior character denylist by using URL-encoded newline (%0a) or ampersand (%26) sequences, which act as command separators after decoding in diagnostic modes such as ping, nslookup, or traceroute. The issue is fixed in version 9.1.5.
OAuthLib versions from 4.5.1_3 up to but not including 4.5.1_14 contain a vulnerability in the device workflow implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation and mishandles public clients. A fix is available in version 4.5.1_14.
CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder where the removal of previously installed seed packages does not properly validate deletion paths. This allows deletion of files outside the intended environment if malicious distribution metadata is present. The flaw occurs during environment creation when reusing an existing environment containing manipulated package metadata. The issue was introduced in version 20.8.1 and fixed in versions 1.6.2 and 1.18.1_2 of the affected product. Exploitation requires attacker-controlled metadata and deletion rights by the invoking user. The CVSS score is 4.5 (medium severity).
A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local unprivileged user to exploit a race condition in the soft-lock stale break restore process. This occurs when the user can write to a shared lock directory without the sticky bit, replacing a lock file marker with a symbolic link. The lock user's process then creates a hard link to one of its own files via the symbolic link, exposing file metadata and allowing the other user to manipulate the file's name. On version 4.2.0, this can lead to truncation of the lock user's file. The vulnerability requires specific conditions including a writable non-sticky directory and CPython 3.12 or later on Linux or macOS. The CVSS 3.1 score is 5.3 (Medium). A fix is available in version 1.18.4 for the related product pipx.
undici's WebSocket client, including Node.js's bundled globalThis.WebSocket, is vulnerable to a denial of service condition caused by unbounded automatic PONG buffering. A malicious WebSocket server can send continuous PING frames causing the client to queue PONG responses without respecting backpressure, leading to memory exhaustion and process termination. This affects undici versions from 5.15.0 up to but not including 6.29.1, 7.0.0 up to 7.30.1, and 8.0.0 up to 8.12.2. Upgrading to versions 6.29.1, 7.30.1, or 8.12.2 mitigates the issue by properly handling backpressure.
A denial of service vulnerability exists in go-jose when parsing JWKs containing RSA keys with crafted parameters. The vulnerability arises because go-jose does not validate bounds on RSA modulus and primes before calling crypto/rsa.PrivateKey.Validate(), which on Go 1.24+ has cubic time complexity relative to key size. This allows an attacker to supply a malicious JWK that causes excessive CPU consumption during parsing. The issue affects go-jose versions prior to 4.1.6 and 3.0.5 and has been fixed in version 4.1.6.
GnuPG version 2.5.21 for Windows has a vulnerability due to default DACL inheritance on the C:\ProgramData directory. This allows low-privilege users to create arbitrary subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
A denial of service vulnerability was identified and addressed in Tanium Enforce. The flaw could allow an attacker with low privileges to cause a denial of service condition, impacting availability. No public exploit or active exploitation is known. The vulnerability has a medium severity rating with a CVSS score of 6.5.
Tanium fixed a vulnerability in its Stream Client Extension where improper certificate validation could allow an attacker to impact confidentiality. The flaw does not affect integrity but may cause limited availability issues. The vulnerability has a CVSS score of 6.5, indicating medium severity.
A denial of service vulnerability has been identified and addressed in Tanium Server. The vulnerability could allow an unauthenticated attacker to cause a denial of service condition, impacting availability. The issue is tracked as CVE-2026-108310 with a medium severity rating and a CVSS score of 5.3.
The CTFer.io Terraform Provider for CTFd versions from 0.1.5 up to but not including 2.8.2 stores the ctfd_team.password value in Terraform state as a non-sensitive value. This means that anyone with access to the Terraform state file can read team passwords without needing additional decryption. The vulnerability is fixed in version 2.8.2.
CVE-2026-102816 is an authorization vulnerability in the country or region configuration interface of the TP-Link RE305 v3 device. An unauthenticated attacker on the same local network can modify the wireless regulatory region settings, causing the device to reapply wireless configurations. Exploitation can disrupt wireless connections, cause channel unavailability, client disconnections, and wireless instability by applying parameters intended for different regulatory regions. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in firmware version 1.1.8 Build 20260921 Rel. 42853.