Threat Intelligence Database

The EventON - Subscriber WordPress plugin up to version 1.4.5 contains an SQL Injection vulnerability via the 'email' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL commands due to insufficient input escaping and lack of query preparation. The vulnerability can be exploited to extract sensitive database information. It has a high severity rating with a CVSS score of 7.5.

CVE-2026-97627 is a high-severity vulnerability in the Atsumi Electric Co., Ltd. ADX5004 DVRs. It involves hidden functionality that allows an administrator-level user to execute arbitrary operating system commands. This could lead to full compromise of the device's confidentiality, integrity, and availability.

A hidden functionality issue in Atsumi Electric Co., Ltd. ADX5004 DVRs allows users with administrator privileges to upgrade the device firmware to unauthorized versions. This vulnerability affects version 0 of the product and has a medium severity rating with a CVSS score of 4.9.

Multiple Digital Video Recorders (DVRs) from Atsumi Electric Co., Ltd. have been identified to contain hidden functionality issues. Specific technical details, affected versions, and exploit information are not provided. No known exploits are reported in the wild, and no patch or remediation information is available.

CVE-2026-113386 is a high-severity vulnerability in Roundcube Webmail that allows remote authenticated attackers to inject CRLF sequences into the _uid parameter in certain mail actions. This injection enables execution of arbitrary IMAP commands. The issue affects Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5.

GNU Project's UnRTF software contains an out-of-bounds write vulnerability. This flaw can be triggered when a user opens a specially crafted RTF file, potentially causing a denial-of-service (DoS) condition. The vulnerability affects UnRTF versions from 0 up to but not including 0.21.12. The CVSS v3.0 base score is 5.4, indicating a medium severity level. There is no indication of confidentiality impact, but integrity and availability impacts are present. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

CVE-2026-113380 is a critical vulnerability in the RingRTC library used by Signal before version 2.72.0. It involves an improper check for unusual or exceptional conditions (CWE-754) where a peer can saturate a call's FSM queue, disrupting the local hangup process and preventing the call teardown, including audio and possibly video tracks.

Several Lenovo tablets have been shipped with a known private test key used for Android Verified Boot. This means the devices may not properly enforce boot integrity checks, potentially allowing unauthorized firmware to be loaded.

UnRTF by GNU Project contains an out-of-bounds write vulnerability. No specific affected versions or technical details are provided. There is no information about patches or known exploits in the wild.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Apache Airflow Amazon provider's AWS auth manager when using SAML authentication. The flaw allows an attacker to cause a victim's browser to complete a SAML login using the attacker's assertion without the victim's knowledge, effectively logging the victim into the attacker's Airflow account. This affects deployments using the AWS auth manager with SAML authentication prior to version 9.38.0. No Airflow account or credentials are required by the attacker, only that the victim visits an attacker-controlled page. The issue is fixed in version 9.38.0.