Critical severity threats

A heap-based buffer overflow vulnerability exists in imgproxy versions 4.0.0 up to but not including 4.0.16. The flaw is due to an integer overflow in the ICO image loader's data_size value, which can cause heap memory corruption. This can lead to process crashes or potentially allow remote code execution.

OpenAM versions from 14.0.0 up to but not including 16.1.4 have an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens via the notification WebSocket. This occurs due to bypassing an agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, enabling attackers to collect iPlanetDirectoryPro tokens and hijack user and administrator sessions. The vulnerability is critical and has been fixed in version 16.1.4.

OpenAM versions before 16.1.4 have an authentication bypass vulnerability in the SAML v2.0 service provider. This flaw allows unauthenticated remote attackers to submit forged unsigned assertions via ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false, enabling them to impersonate any mapped user, including administrators, and hijack single sign-on sessions.

OpenAM versions prior to 16.1.4 contain a privilege management vulnerability that allows anonymous attackers to bypass attribute restrictions during self-registration. This flaw enables attackers to assign themselves to administrative groups via legacy self-service REST endpoints or the User Self-Service flow, resulting in full administrative control over OpenAM.

CVE-2026-124060 is a critical buffer overflow vulnerability in the TOTOLINK CA300-PoE router, specifically in version 6.2c.884. The flaw exists in the UploadCustomModule function within the /cgi-bin/cstecgi.cgi file, where improper handling of the File argument can lead to a buffer overflow. This vulnerability can be exploited remotely without user interaction and requires high privileges. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-124059 is a critical buffer overflow vulnerability in the TOTOLINK CA300-PoE device, specifically in version 6.2c.884. The flaw exists in the setWiFiWdsAddConfig function within the /cgi-bin/cstecgi.cgi file, where improper handling of the ApCliKeyStr argument can lead to a buffer overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed, increasing the risk of exploitation.

CVE-2026-124058 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWiFiRepeaterConfig function of the /cgi-bin/cstecgi.cgi file, where manipulation of the ApCliKeyStr argument can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code is available, increasing the risk of attacks.

CVE-2026-124057 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWiFiMultipleConfig function within the /cgi-bin/cstecgi.cgi file. An attacker can remotely trigger this vulnerability by manipulating the Key1Str1 argument, potentially leading to arbitrary code execution. Public exploit code has been released, increasing the risk of exploitation. No patch or remediation information is currently available.

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress versions up to and including 3.8.0 contains a vulnerability that allows unauthenticated attackers to delete arbitrary attachments. This occurs due to a missing capability or ownership check in the ajax_remove_uploaded() function, which is accessible via both authenticated and unauthenticated AJAX endpoints and protected only by a nonce exposed on the public checkout page. Exploitation can lead to loss of important media files and potential denial of service.

CVE-2026-123966 is a critical heap-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the saveParentControlInfo function, specifically in the handling of the deviceId argument in the /goform/saveParentControlInfo endpoint. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, increasing the risk of exploitation.

CVE-2026-120984 is a critical vulnerability in the Red Hat Build of Keycloak server's client management component. It occurs when a client is created or imported with authorization services enabled, and the system fails to clear an internal session attribute properly. This flaw allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy. The malicious script executes on the server during authorization requests, potentially enabling arbitrary code execution and full system compromise. Exploitation requires elevated privileges and authenticated access. No official fix or mitigation is currently available from Red Hat.

The Registration Form for WooCommerce plugin for WordPress versions up to and including 1.1.4 contains a privilege escalation vulnerability. This flaw arises from a missing allow-list check in the checkout registration path, allowing unauthenticated attackers to assign themselves the Administrator role during account creation at checkout. This results in full site takeover.

The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.6 is vulnerable to an authentication bypass via account takeover. This vulnerability arises from improper handling of SQL query conditions in the plugin's code, allowing unauthenticated attackers to reset passwords of arbitrary customers and gain full access to their bookings, orders, and personal information. When a specific plugin option is enabled, attackers can also take over linked WordPress user accounts.

A critical buffer overflow vulnerability exists in TOTOLINK CA300-PoE firmware version 6.2c.884, specifically in the setWiFiBasicConfig function of /cgi-bin/cstecgi.cgi. The flaw is triggered by manipulating the KeyStr argument remotely, potentially allowing complete compromise of confidentiality, integrity, and availability. Public exploit code has been disclosed. No patch or remediation information is currently available.