Threat Intelligence Database

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.

Multiple Digital Video Recorders (DVRs) from Atsumi Electric Co., Ltd. have been identified to contain hidden functionality issues. Specific technical details, affected versions, and exploit information are not provided. No known exploits are reported in the wild, and no patch or remediation information is available.

CVE-2026-113386 is a high-severity vulnerability in Roundcube Webmail that allows remote authenticated attackers to inject CRLF sequences into the _uid parameter in certain mail actions. This injection enables execution of arbitrary IMAP commands. The issue affects Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5.

GNU Project's UnRTF software contains an out-of-bounds write vulnerability. This flaw can be triggered when a user opens a specially crafted RTF file, potentially causing a denial-of-service (DoS) condition. The vulnerability affects UnRTF versions from 0 up to but not including 0.21.12. The CVSS v3.0 base score is 5.4, indicating a medium severity level. There is no indication of confidentiality impact, but integrity and availability impacts are present. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

CVE-2026-113380 is a critical vulnerability in the RingRTC library used by Signal before version 2.72.0. It involves an improper check for unusual or exceptional conditions (CWE-754) where a peer can saturate a call's FSM queue, disrupting the local hangup process and preventing the call teardown, including audio and possibly video tracks.

Several Lenovo tablets have been shipped with a known private test key used for Android Verified Boot. This means the devices may not properly enforce boot integrity checks, potentially allowing unauthorized firmware to be loaded.

UnRTF by GNU Project contains an out-of-bounds write vulnerability. No specific affected versions or technical details are provided. There is no information about patches or known exploits in the wild.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Apache Airflow Amazon provider's AWS auth manager when using SAML authentication. The flaw allows an attacker to cause a victim's browser to complete a SAML login using the attacker's assertion without the victim's knowledge, effectively logging the victim into the attacker's Airflow account. This affects deployments using the AWS auth manager with SAML authentication prior to version 9.38.0. No Airflow account or credentials are required by the attacker, only that the victim visits an attacker-controlled page. The issue is fixed in version 9.38.0.