Threats affecting pkg:generic/radare2

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function launch_goal of the file im_client/communication/communication_layer.py of the component Collaboration Layer. Performing a manipulation of the argument max_turns results in infinite loop. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.

CVE-2026-123467 is a missing authorization vulnerability in StylemixThemes Motors plugin for WordPress, affecting versions before 1.4.129. It allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The vulnerability has a medium severity score of 4.3 and is fixed in version 1.4.129.

CVE-2026-122659 is a missing authorization vulnerability in WP ManageNinja LLC's Fluent Booking plugin affecting versions before 2.6.0. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure or modification. The issue is fixed in version 2.6.0.

CVE-2026-121579 is a stored cross-site scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) affecting versions before 2.0.28. The flaw involves improper neutralization of input during web page generation, which can lead to persistent injection of malicious scripts. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fixed version, 2.0.28, is available to address this issue.

CVE-2026-121575 is a missing authorization vulnerability in WP User Manager versions prior to 2.10.5. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-122660 is a missing authorization vulnerability in BAKKBONE Australia FloristPress versions prior to 7.8.6. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity. The issue has a medium severity rating with a CVSS score of 4.3. A fix is available in version 7.8.6.

CVE-2026-123483 is a medium severity vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8.1. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects versions from initial releases up to 3.6.8. The issue has been fixed in version 3.6.8.1.

CVE-2026-123183 is a Cross-Site Scripting (XSS) vulnerability in PluginUs.Net's Active Products Tables for WooCommerce plugin. The flaw allows improper neutralization of script-related HTML tags, enabling code injection. Versions from initial release through 2.1.6 are affected. The issue is fixed in version 2.1.7.

CVE-2026-123474 is a missing authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress. It affects versions from initial releases up to 2.3.18. The flaw allows unauthorized network attackers to exploit incorrectly configured access control, potentially leading to limited confidentiality impact. A fix is available in version 2.3.19.

CVE-2026-121775 is a missing authorization vulnerability in VillaTheme CURCY woo-multi-currency plugin versions before 2.2.21. The flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue has a medium severity rating and a CVSS score of 5.3.

CVE-2026-123462 is a missing authorization vulnerability in the myCred plugin affecting versions before 4.0.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue is fixed in version 4.0.3.

CVE-2026-122669 is a stored cross-site scripting (XSS) vulnerability in Everest Forms versions prior to 3.6.4. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of other users. The vulnerability is fixed in version 3.6.4.

CVE-2026-122663 is a missing authorization vulnerability in VillaTheme CURCY woo-multi-currency plugin versions before 2.2.21. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 2.2.21.

CVE-2026-121784 is a stored cross-site scripting (XSS) vulnerability in the WpBookingly plugin by Magepeople inc. It affects versions from initial through 1.4.3. The vulnerability involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. A fix is available in version 1.4.4.

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process. The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().