The Link Library WordPress plugin versions before 7.10.0 have a vulnerability where it does not verify that a requested link belongs to the settings set used to render it. This flaw allows unauthenticated users to access sensitive information such as telephone numbers, email addresses, and submitter names that the settings set is configured not to display.
The Link Library WordPress plugin versions prior to 7.10.0 contain a vulnerability where the plugin fails to re-check the login requirement of the selected library during front-end link submissions. This flaw allows unauthenticated users to submit links to libraries that are configured to require login by reusing a form token from another library that does not require login.
An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.
PiWeb Disable payment method / Partial payment for WooCommerce versions before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler. This flaw allows unauthenticated attackers to modify and read other customers' orders by reusing a nonce from their own order-pay page and supplying sequential order_id values. The vulnerability enables attackers to change payment methods, recalculate fees, and disclose order details such as line items and totals.
OpenCATS versions prior to 0.10.0 contain a vulnerability in the Professional License configuration feature that allows an authenticated administrator with Settings module access to inject arbitrary PHP code. This occurs because license key input is unsafely incorporated into a PHP define() statement in config.php, which is writable. Exploitation can lead to persistent arbitrary PHP execution with web server privileges, enabling data exposure, modification, or deletion, and potential further compromise. The issue is fixed in version 0.10.0.
CVE-2026-118537 is a medium severity vulnerability in the a2ui library up to version 0.10.4. It involves improper input validation in the Image component's handling of the 'url' argument, potentially allowing remote manipulation. A fix has been developed but is pending acceptance. No known exploits are reported in the wild.
OpenCATS versions prior to 0.10.0 contain an improper input validation vulnerability in the activity DataGrid date filtering functionality. Authenticated users can manipulate the 'period', 'startDate', and 'endDate' parameters to alter SQL queries without proper escaping, potentially accessing sensitive database information. This issue is fixed in version 0.10.0.
Seroval versions 1.6.0 through 1.6.10 contain a vulnerability where typed arrays that have an own constructor property set from untrusted data can lead to code injection during serialization. This occurs because the constructor name is read from a mutable property on the typed array rather than its internal type, allowing arbitrary code to be serialized. The issue is fixed in version 1.6.11. The vulnerability requires unusual conditions where properties from untrusted objects are copied onto typed arrays.
Seroval versions before 1.0.0 and from 1.5.5 up to but not including 1.6.10 improperly serialize RegExp sources containing the '<' character without escaping it. This can allow an attacker to inject script code if the RegExp is built from untrusted input and the serialized output is placed inside an HTML <script> element. The vulnerability is fixed in version 1.6.10 by changing the serialization method to use the RegExp constructor with an escaped string source.
The Phi-4 multimodal audio encoder in vLLM versions prior to 0.32.0 runs its conformer attention in eager mode by default, which fully materializes and retains large attention matrices per layer during audio processing. This causes GPU memory to grow monotonically within a single request, leading to out-of-memory errors and a crash of the entire server when processing a 10-minute audio clip. The retained attention matrices persist beyond request completion, causing sustained high memory usage. This vulnerability allows any unauthenticated client with API access to cause a full denial of service with a single legal audio request.
The filelock library on Windows ignores the 'mode' argument when creating lock files, causing files intended to have restrictive permissions (0o600) to inherit the directory's ACL instead. This allows other local accounts with read or modify access to the directory to read or write the lock files and interfere with the locking mechanism. The issue affects filelock versions 3.10.0 through 4.2.0 on Windows and is confirmed by the maintainers. Unix systems are not affected. A fix is available in version 4.2.1.
A vulnerability in honojs node-server versions from 1.19.10 up to but not including 2.1.3 allows an unauthenticated attacker to bypass middleware protections on static file serving. The issue arises because the serveStatic function decodes the request path a second time after initial decoding by Hono, leading to inconsistent path evaluation. This can cause the static file handler to serve files from within the configured static root directory that should be protected by middleware. The flaw does not allow directory traversal outside the static root. The vulnerability is fixed in version 2.1.3.
CVE-2026-118257 is a high-severity cross-site scripting (XSS) vulnerability in the vue-i18n internationalization plugin for Vue.js. The flaw affects versions 9.14.5, 10.0.8, and versions from 11.1.10 up to but not including 11.4.14, as well as 12.0.0-alpha.4 up to but not including 12.0.0-alpha.5. The vulnerability arises because the sanitizeTranslatedHtml() function escapes markup and event-handler text inside an iframe srcdoc attribute but leaves the srcdoc attribute active, allowing browsers to parse attacker-controlled content as same-origin nested HTML. This can lead to script execution when escapeParameter is enabled and translations are rendered as HTML via v-html. The issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
Highcharts JS versions from 10.0.0 up to but not including 11.4.9, 12.0.0 up to but not including 12.6.1, and 13.0.0 up to but not including 13.1.1 are vulnerable to a cross-site scripting (XSS) issue. The vulnerability arises because Highcharts applies breadcrumbs.style as SVG attributes without filtering attribute names, allowing attackers controlling chart configuration to inject event-handler keys. This leads to execution of malicious scripts in the context of the hosting page when users interact with breadcrumb buttons. Styled-mode charts are not affected. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
Highcharts JS versions from 10.3.2 up to but not including 11.4.9, 12.0.0 up to 12.6.2, and 13.0.0 up to 13.1.1 contain a cross-site scripting (XSS) vulnerability. This occurs because the SVG anchor xlink:href attribute does not enforce the allowed-scheme check that is applied to href and src attributes. An attacker controlling chart text options can embed a javascript URL that executes script when the exported or server-rendered SVG is parsed and the link is activated. The issue is fixed in versions 11.4.9, 12.6.2, and 13.1.1.
CVE-2026-88967 is a server-side request forgery (SSRF) vulnerability in Grafana Enterprise affecting users with query access to an Azure Monitor data source. Exploiting this flaw allows an attacker to cause the server to make requests to attacker-controlled endpoints, potentially disclosing the Azure access token associated with the data source. This vulnerability affects multiple versions of Grafana Enterprise from 10.0.0 through 13.2.4. A patch is available to address this issue.
Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size (socket.request.max.bytes); it was not checked against the remaining buffer bytes or capped. Because each entry can be encoded in as little as two bytes (unknown tag 0, size 0), a modest request can declare tens of millions of tagged fields and force one object allocation per declared field. Flexible request headers (header version 2, used by flexible APIs such as ApiVersions v3) are parsed this way, so the amplification applies to the request header itself.
Impact:
The flexible request header is parsed on the network thread before authorization, request dispatch, and request-time quota accounting. A client can send a request of a few tens of megabytes whose header declares about 20 million tagged fields, forcing roughly that many RawTaggedField allocations and exhausting broker heap or inducing process-wide GC stalls, denying broker service. Because the header is parsed for pre-authentication APIs such as ApiVersions (v3), the allocation can occur before authentication; no Kafka resource ACL or quota is required.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. Until then, lowering socket.request.max.bytes and restricting network access to broker listeners reduces, but does not remove, exposure.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: generated readers bounds-check the tagged-field count for flexible-versioned messages, rejecting a negative count, a count exceeding the remaining buffer bytes, or a count exceeding a fixed maximum (10,000), before any per-field allocation.