HCL AION contains a vulnerability where it trusts the HTTP Host header value without validation. This flaw allows an attacker to manipulate the Host header to influence links, redirects, or responses generated by the application, potentially causing unintended behavior or security impacts under certain conditions. The vulnerability is classified under CWE-74 (Injection).
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
Cronicle versions prior to 0.9.124 contain an incorrect authorization vulnerability that allows authenticated non-admin users with certain privileges to supply undeclared keys in event parameters. These keys can override security-sensitive environment variables used by plugins, potentially leading to privilege escalation, arbitrary code execution, data access, or service disruption. The issue is fixed in version 0.9.124.
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.
Effect-TS, a TypeScript framework, has a vulnerability in versions from 0.1.0 up to but not including 0.97.1 and 4.0.0-beta.0 up to but not including 4.0.0-beta.103. The vulnerability allows injection of semicolon delimiters in cookie attributes via the name, domain, and path fields passed to makeCookie(), which serializeCookie() writes verbatim into Set-Cookie headers. This can enable an attacker to append cookie attributes such as a broader Domain, SameSite=None, or Max-Age, potentially widening cookie scope or altering cookie behavior. The issue is fixed in versions 0.97.1 and 4.0.0-beta.103.
CVE-2026-57154 is a high-severity injection vulnerability in the OPNsense core firewall and routing platform prior to versions 26.1.11 and 26.4.1p1. Authenticated users with delegated access to certain settings can inject carriage return or line feed characters into single-line fields, causing privileged service configuration files to include attacker-controlled directives. This affects multiple services including Dnsmasq, OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP/MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Exploitation can lead to altered service behavior, crossing of RBAC boundaries, denial of service, and in some cases root command execution. The issue is fixed in versions 26.1.11 and 26.4.1p1.
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an injection vulnerability (CWE-74) that allows a high privileged attacker with adjacent network access to perform script injection. This vulnerability can lead to high impact on confidentiality, integrity, and availability. The issue is fixed in version 4.8.0 and later.
A vulnerability in the Formidable Forms WordPress plugin (versions up to and including 6.35) allows authenticated users with subscriber-level access or higher to install arbitrary plugins. This occurs due to insufficient validation of the 'file_url' parameter and improper permission checks relying on a shared token without verifying higher privileges. The issue affects sites using the free version of the plugin (not Formidable Pro).
OpenCATS versions prior to 0.10.0 contain a vulnerability in the Professional License configuration feature that allows an authenticated administrator with Settings module access to inject arbitrary PHP code. This occurs because license key input is directly used in a PHP define() statement in config.php without proper escaping, enabling persistent code execution with web server privileges. The vulnerability is fixed in version 0.10.0.
A vulnerability in i18next-http-backend prior to version 4.0.4 allows injection via unencoded language and namespace values in URL templates. This can let an attacker manipulate query parameters in translation requests, potentially exposing other namespaces or tenants or altering backend behavior. The issue is fixed in version 4.0.4.
An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.
CVE-2026-103400 is an injection vulnerability (CWE-74) in the ember service of Juniper Networks Session Smart Router and Session Smart Conductor. It allows a local attacker to create specially named directories that can lead to unmounting arbitrary filesystems or cause a denial of service when the service is restarted. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS v3.1 base score is 5.5, indicating medium severity, with an attack vector requiring local access and no impact on confidentiality or integrity but causing availability disruption.
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
CVE-2026-115932 is a critical path traversal vulnerability in GitroomHQ's postiz-app affecting versions from 2.23.0 up to but not including 2.25.3. It allows a registered user to craft a media path that bypasses normal checks and causes the publishing worker to read arbitrary files on the server. These files can then be sent as attachments to a Discord server controlled by the attacker. Additional routes enable file existence checks and file delivery, potentially exhausting backend memory. Self-registration is enabled by default, so no prior account is needed to exploit this issue.
Heimdall versions prior to 0.17.17 have an improper input validation vulnerability in proxy mode where the Host header value is inserted unsanitized into the Forwarded HTTP header. This allows attackers to inject additional parameters, potentially spoofing IP addresses for upstream services. The issue is fixed in version 0.17.17.
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
CVE-2026-114655 is an injection vulnerability in MongoDB's libmongocrypt library affecting versions 1.0.0 up to but not including 1.21.1. The library improperly inserts unvalidated values from key vault documents and KMS configurations into requests to external key management services, allowing a user with write access to the key vault collection to manipulate request structures and signed tokens. This can cause key management operations to execute with unintended parameters. A fix is available in version 1.21.1.
MISP versions prior to 2.5.48 contain a CSS injection vulnerability in the remote event preview feature. This occurs because the colour value of remote tags is inserted directly into an inline CSS style attribute without sufficient validation. An attacker controlling a linked MISP server can inject arbitrary CSS by crafting malicious tag colour values, which are then rendered when a user previews events from that linked server. This can lead to UI manipulation, visual spoofing, or limited information disclosure via CSS techniques.
CVE-2026-55453 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where the quote_string() function in backend/ipp.c improperly preserves carriage-return and line-feed characters in a remote printer-controlled marker-message. This allows an attacker to inject newline characters that the scheduler interprets as separate PPD control lines, enabling persistence of attacker-selected PPD keywords. A demonstrated exploit involves injecting a FoomaticRIPCommandLine value that executes in the filter context during a later print job on a Foomatic-backed queue. The issue is fixed in version 2.4.20.