product: Easy Invoice

vendor: MantraBrain

summary: Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.


default_status: unaffected

product: Unlimited Elements For Elementor

vendor: Unlimited Elements

status: unaffected

status: affected

version_type: custom

ecosystem: software/application

metric_type: Secondary

severity: high

quality: metadata-backed

recipe_kind: composed

status: Deferred

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection. This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.

title: Unlimited Elements Unlimited Elements For Elementor security vulnerability


product: Post SMTP

vendor: WPExperts

summary: Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.


product: WP Statistics

vendor: VeronaLabs

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6.

title: Veronalabs Wp Statistics security vulnerability


product: Exim

vendor: Exim

archetype: generic

severity: medium

part: a

product: exim

vendor: exim

status: Modified

summary: Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

title: Exim security vulnerability


product: Webmail

vendor: Roundcube

version_type: semver

summary: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

title: Roundcube Webmail security vulnerability


archetype: ssrf

summary: Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.


summary: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)


summary: In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.


summary: In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.


summary: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.


summary: In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.


product: PuTTY

vendor: PuTTY

metric_type: Primary

severity: low

product: putty

vendor: putty

status: Analyzed

summary: PuTTY 0.72 before 0.84 has a double free in RSA KEX.


product: grpc

vendor: elixir-grpc

version_type: git

severity: critical

summary: Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc from 0.4.0 before 1.0.0.

title: Elixir-Grpc Grpc security vulnerability


summary: Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node. This issue affects grpc from 0.3.1 before 1.0.0.

title: Elixir-Grpc Grpc security vulnerability


default_status: unknown

product: OTP

vendor: Erlang

version_type: otp

product: erlang/otp

vendor: erlang

product: erlang/ssh

summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /. The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.


product: erlang/inets

summary: Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host. autoredirect defaults to true, so this affects all httpc callers that do not explicitly disable automatic redirects. An attacker who controls a server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also control. The Authorization header (including Basic credentials derived from URL userinfo via httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same applies to the Proxy-Authorization header. This vulnerability is associated with program files lib/inets/src/http_client/httpc_response.erl.


product: ftp

summary: Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts. The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false).

title: Erlang Erlang/Inets security vulnerability


summary: Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication. When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames. The user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability. This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl. This issue affects OTP from OTP 29.0 before OTP 29.0.2, corresponding to ssh from 6.0 before 6.0.1.

title: Erlang Erlang/Otp security vulnerability


product: erlang/ssl

summary: Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9.


product: mint

vendor: elixir-mint

summary: Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding. In lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check. HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory. This issue affects mint: from 0.2.0 before 1.9.0.

title: Elixir-Mint Mint security vulnerability


product: libsolv

vendor: OpenSUSE

status: Awaiting Analysis

summary: A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

title: A flaw was found in libsolv


default_status: affected

product: Red Hat Enterprise Linux 10

vendor: Red Hat

version_type: rpm

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Enterprise Linux 7 Extended Lifecycle Support

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9

product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

author: Codex

description: CVE-2026-48864 is libsolv leftover. GHAD vulnerabilities empty. NVD CPE is exact 0.7.36. Do not invent 0.7.37.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-48864: libsolv leftover dump, no named floor

vendor: opensuse

vendor: redhat

product: satellite

part: o

recipe_kind: markdown-draft

summary: A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.

title: A flaw was found in libsolv


product: LearnPress

vendor: ThimPress

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue affects LearnPress: from n/a through 4.3.6.

title: Thimpress Learnpress security vulnerability


product: Gravity Forms

vendor: Rocketgenius Inc.

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.


product: Quiz And Survey Master

vendor: ExpressTech

summary: Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.


product: Simple Shopping Cart

vendor: mra13 / Team Tips and Tricks HQ

summary: Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.


product: Enfold

vendor: Kriesi

summary: Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.


product: King Addons for Elementor

vendor: King Addons

summary: Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.


product: MW WP Form

vendor: Takashi Kitajima

summary: Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.


product: EmbedPress

vendor: WPDeveloper

summary: Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.


product: Montonio for WooCommerce

vendor: Montonio

summary: Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.


product: GamiPress

vendor: Ruben Garcia

summary: Subscriber SQL Injection in GamiPress <= 7.8.7 versions.


product: JetSmartFilters

vendor: Jetimpex Inc.

summary: Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.


product: Stop Spammers

vendor: Web Guy

summary: Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.


product: GenerateBlocks

vendor: Tom

summary: Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBlocks: from n/a through 2.1.0.


product: Visual Link Preview

vendor: Bootstrapped Ventures

summary: Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.


product: AIWU

vendor: Sergey

summary: Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue affects AIWU: from n/a through 1.4.17.


product: WP Job Portal

vendor: Ahmad

summary: Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.


product: TrueBooker

vendor: themetechmount

summary: Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.


product: WP Time Slots Booking Form

vendor: codepeople

summary: Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.


product: WPC Product Bundles for WooCommerce

vendor: WPClever

summary: Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.


product: HollerBox

vendor: Groundhogg

summary: Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.


product: JS Help Desk

summary: Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.


summary: Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.


product: Amelia

vendor: TMS

summary: Subscriber Privilege Escalation in Amelia <= 2.3 versions.


product: Apache Airflow

vendor: Apache Software Foundation

product: airflow

vendor: apache

summary: A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep.source` and `dep.target` fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigger / sensor references. Affects deployments that rely on per-Dag read scoping to keep Dag identifiers private across teams. This is a residual gap in the fix for CVE-2026-28563, which filtered the top-level Dag key but did not propagate the filter into the trigger / sensor dep-source / dep-target fields. Users who already upgraded for CVE-2026-28563 should additionally upgrade to `apache-airflow` 3.3.0 or later to cover the residual trigger / sensor dependency leak.

title: Apache Airflow security vulnerability


summary: The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later.

title: Apache Airflow security vulnerability


product: Apache APISIX

product: apisix

summary: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.


product: Joomla! CMS

vendor: Joomla! Project

product: joomla!

vendor: joomla

summary: Insufficient state checks lead to a vector that allows to bypass 2FA checks.


title: Insufficient state checks lead to a vector that allows to bypass 2FA checks


summary: An improper access check allows privilege escalation through the com_users batch task.


title: An improper access check allows privilege escalation through the com_users batch task


summary: An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.


summary: The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.


summary: The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.


product: Joomla! Framework Filter package

summary: Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.


summary: An improper access check allows privelege escalation through the com_users group editing webservice endpoint.


summary: Lack of input filtering leads to an XSS vector in the HTML filter code.


product: Convert Forms

product: EngageBox

product: Google Structured Data

product: Advanced Custom Fields

product: Smile Pack

product: Tassos Code Snippets

product: MailChimp Auto-Subscribe

vendor: tassos

product: engagebox

summary: The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.


product: Joomla Content Editor (JCE) extension for Joomla

business_risk: Critical remote compromise risk. Unauthenticated users can create or upload editor profiles that permit executable-file uploads, potentially leading to PHP code execution and compromise of confidentiality, integrity, and availability. NVD records the issue as actively exploited and listed in CISA KEV.

claim: The vulnerability affects the JCE editor extension for Joomla and is described as allowing unauthenticated users to create editor profiles leading to PHP code upload and execution.

claim: NVD records the affected CPE range as versions up to, but excluding, 2.9.99.5; the vendor states that all JCE versions prior to 2.9.99.5 are affected.

claim: The attack requires an unauthenticated reachable site and abuses an editor profile that permits executable-file uploads; the vendor states that sites without public registration are not necessarily safe.

kind: exposure

claim: The vendor states that JCE Pro 2.9.99.5 fixes the vulnerability and recommends JCE Pro 2.9.99.9 for every site.

claim: The vendor directs users to update to 2.9.99.5 or later, apply the security patch for older JCE 2.7.x through 2.9.x versions when updating is not possible, or uninstall JCE if neither option is available.

kind: remediation

claim: The vendor provides inert post-deployment checks including reviewing JCE Editor Profiles, examining hosting access logs for unauthenticated profile-import activity, inspecting relevant storage locations for unexpected script files, and conducting a server-side malware scan.

kind: verification

claim: NVD records the CVE in CISA’s Known Exploited Vulnerabilities Catalog with active exploitation and a required mitigation action.

exposure_conditions: JCE is installed in an affected version prior to 2.9.99.5, including the vendor-identified affected range through 2.9.99.4.

exposure_conditions: The Joomla site is reachable by unauthenticated remote users; public registration is not required for exploitation.

exposure_conditions: An attacker can use the vulnerable profile-import functionality to create an editor profile that permits executable-file uploads.

remediation_steps: Update JCE to version 2.9.99.5 or later; the vendor currently recommends JCE Pro 2.9.99.9 for every site.

remediation_steps: For systems that cannot update to 2.9.99.6 or later, apply the vendor’s security patch for JCE 2.7.x through 2.9.x using the Joomla Installer. Treat this as a stopgap because it does not include later hardening.

remediation_steps: If neither updating nor applying the vendor patch is feasible, uninstall JCE.

remediation_steps: Assume a site may be compromised if it was running an affected version during exposure. Preserve relevant evidence, update first, then remove unauthorized JCE profiles and suspicious uploaded files, rotate potentially exposed credentials, and perform a full server-side malware scan.

remediation_steps: Prioritize remediation in accordance with the applicable CISA Known Exploited Vulnerabilities requirements and assess internet exposure for each affected asset.

status: complete

uncertainty: The supplied record identifies the affected range as 1.0.0 through 2.9.99.4, while the vendor advisory describes all versions prior to 2.9.99.5 as affected; this enrichment follows the vendor and NVD fixed-version boundary.

uncertainty: The vendor notes that JCE 2.6.x does not appear affected in its default configuration but states that this has not been independently verified; no definitive affected-status conclusion is made for that branch.

uncertainty: The presence, timing, and scope of compromise on any particular asset cannot be determined without local version, profile, file, and server-log evidence.

uncertainty: The vendor’s recommended 2.9.99.9 release is newer than the minimum CVE fix and includes additional security hardening; the CVE remediation boundary is 2.9.99.5 or later.

verification_steps: Confirm through the Joomla administration interface that the installed JCE version is 2.9.99.5 or later; preferably verify the vendor-recommended 2.9.99.9 or later.

verification_steps: Review JCE Editor Profiles for profiles that were not intentionally created, especially profiles with automatically generated names or permissions allowing PHP/script-file uploads.

verification_steps: Review web-server access logs supplied by the hosting provider for unauthenticated requests associated with the JCE profile-import functionality. Treat matching activity as an incident indicator rather than performing a live probe.

verification_steps: Inspect the site’s images, media, and temporary storage locations for unexpected PHP or script files, and use a server-side malware scan to check for additional compromise.

verification_steps: Do not treat successful version updating as evidence that a previously compromised site has been cleaned; the vendor states that updating closes the entry point but does not remove attacker-installed artifacts.

known_ransomware_campaign_use: Unknown

notes: https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites ; https://www.joomlacontenteditor.net/support/changelog/editor ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48907

product: Joomla Content Editor

required_action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

vendor_project: Widget Factory

vulnerability_name: Widget Factory Joomla Content Editor Improper Access Control Vulnerability

description: CVE-2026-48907 is a CISA KEV improper-access flaw in Joomla Content Editor before 2.9.99.5. Upgrade to 2.9.99.9 or apply the vendor stopgap patch, then review profiles and uploads.

title: CVE-2026-48907: JCE Unauthenticated Profile Import Remediation

product: jce

vendor: widgetfactorylimited

summary: A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.


product: SP Page Builder extension for Joomla

notes: https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

product: SP Page Builder

vendor_project: JoomShaper

vulnerability_name: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

description: CVE-2026-48908 is SP Page Builder for Joomla unauthenticated arbitrary file upload. GHSA-8fwr-8fxr-8v2p names no version range and no floor.

title: CVE-2026-48908: Joomla SP Page Builder Upload, No Named Floor

vendor: ollyo

summary: A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.


product: SP LMS extension for Joomla

summary: SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

title: Joomshaper.Net Sp Lms Extension For Joomla security vulnerability


product: Apache JSPWiki

ecosystem: javascript/npm

product: jspwiki

summary: A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.

title: Apache Jspwiki security vulnerability


product: Apache Answer

product: answer

summary: Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. Users are recommended to upgrade to version 2.0.2, which fixes the issue.


summary: Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.


product: Apache HTTP Server

summary: Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.


product: Red Hat Enterprise Linux 9

vendor: Red Hat

product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux for NVIDIA 26

product: Red Hat OpenShift Container Platform 4

part: redhat

summary: A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.


product: Jenkins LDAP Plugin

vendor: Jenkins Project

version_type: maven

product: ldap

vendor: jenkins

summary: Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.


summary: Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.


product: Jenkins Active Directory Plugin

summary: Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.


summary: Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.


product: Jenkins Email Extension Plugin

summary: Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

title: Jenkins Email Extension security vulnerability


summary: Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

title: Jenkins Pipeline: Groovy Libraries security vulnerability


product: Jenkins Credentials Binding Plugin

summary: Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.

title: Jenkins Credentials Binding security vulnerability


product: Jenkins AppSpider Plugin

product: appspider

summary: Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

title: Jenkins Appspider security vulnerability


product: Jenkins Bitbucket OAuth Plugin

summary: Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

title: Jenkins Bitbucket Oauth security vulnerability


product: Jenkins GitHub Integration Plugin

vendor: kostyasha

summary: A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

title: Kostyasha Github Integration security vulnerability


product: Jenkins Job Import Plugin

summary: Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

title: Jenkins Job Import security vulnerability


product: Jenkins buildgraph-view Plugin

product: buildgraph-view

summary: Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views.

title: Jenkins Buildgraph-View security vulnerability


product: node

vendor: nodejs

summary: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.


summary: Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an unauthenticated DDP WebSocket connection, Meteor.userId() returns null, causing the authorization check to be skipped. Execution falls through to FileUpload.getStore('Uploads').deleteById(fileID), which removes the file from storage and database unconditionally. File IDs are discoverable from public channel message payloads and download URLs.

title: Rocket.Chat security vulnerability


description: CVE-2026-48930 is silent TLS authority rebinding from embedded-NUL hostnames in Node.js. GHSA-g779-8rvr-37xx names no version range and no floor.

title: CVE-2026-48930: Node.js Embedded-NUL Hostname, No Named Floor

summary: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

title: Nodejs Node.Js security vulnerability


product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Enterprise Linux 9

product: Red Hat Hardened Images

description: CVE-2026-48933 crashes Node.js when subtle.encrypt() input is a multiple of 2GiB. GHSA last-names Node.js 22, 24, and 26. Do not invent a point release.

title: CVE-2026-48933: Node.js WebCrypto 2GiB Crash, 22 / 24 / 26

summary: A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.


summary: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.


summary: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.


product: iCagenda extension for Joomla

business_risk: Critical risk: CVE-2026-48939 permits unauthenticated arbitrary-file upload through iCagenda’s file-attachment functionality, potentially enabling PHP code upload and remote code execution with impacts to confidentiality, integrity, and availability. CISA lists the vulnerability in its Known Exploited Vulnerabilities Catalog, so affected deployments should receive urgent treatment.

claim: CVE-2026-48939 affects the iCagenda extension for Joomla and involves arbitrary file upload through the file-attachment feature, with potential PHP code upload and execution.

claim: NVD identifies iCagenda versions 3.2.1 through versions before 3.9.15, and versions 4.0.0 through versions before 4.0.8, as affected.

claim: The vulnerability is remotely exploitable without authentication according to the NVD description and the vendor’s security-release notes describing a full unauthenticated remote-code-execution issue.

claim: The iCagenda 4.0.8 release is a critical security release that fixes a full unauthenticated remote-code-execution issue.

claim: A safe primary verification is to confirm that deployed versions are outside the NVD-listed affected ranges and match the vendor’s security-release versions 3.9.15 or 4.0.8, as applicable.

exposure_conditions: The iCagenda extension for Joomla is installed in an affected version.

exposure_conditions: The file-attachment functionality is reachable by an unauthenticated remote user.

exposure_conditions: The affected Joomla application is remotely reachable, particularly from the internet or other untrusted networks.

remediation_steps: Upgrade iCagenda 3.x installations to version 3.9.15 or later.

remediation_steps: Upgrade iCagenda 4.x installations to version 4.0.8 or later.

remediation_steps: If an affected installation cannot be upgraded promptly, restrict unauthenticated access to the Joomla application and iCagenda file-attachment functionality as an interim risk-reduction measure, consistent with vendor and CISA guidance.

remediation_steps: Because CISA identifies this CVE as exploited, assess potentially exposed systems for compromise using established incident-response and forensic procedures before and after remediation.

uncertainty: The vendor release notes confirm that the listed releases fix a critical unauthenticated remote-code-execution issue but do not provide detailed implementation or detection guidance.

uncertainty: The available authoritative sources do not establish a specific malicious file name, upload path, forensic indicator, or vendor-provided temporary configuration workaround.

uncertainty: The exact exposure of an individual deployment depends on its Joomla routing, access controls, network reachability, and enabled iCagenda functionality.

verification_steps: Confirm the installed iCagenda version is at least 3.9.15 for the 3.x branch or at least 4.0.8 for the 4.x branch.

verification_steps: Confirm that no affected versions remain deployed across Joomla instances, backups, staging systems, or externally exposed sites.

verification_steps: Review application and web-server security logs for unexpected file uploads or PHP execution associated with iCagenda’s file-attachment functionality; do not perform exploit testing against production systems.

verification_steps: Confirm that the vendor release is recorded as applied and that unauthenticated access to the relevant functionality is subject to the intended access controls.

notes: https://www.icagenda.com/#download ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48939

product: iCagenda

vendor_project: iCagenda

vulnerability_name: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

description: CVE-2026-48939 is iCagenda for Joomla arbitrary file upload via attachments. GHSA-4rh3-rmh3-hv6h names no version range and no floor.

title: CVE-2026-48939: Joomla iCagenda Attachment Upload, No Named Floor

product: icagenda

vendor: joomlic

summary: A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.


product: K2 extension for Joomla

vendor: joomlaworks

summary: The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`

title: Joomlaworks K2 security vulnerability


summary: K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

title: Joomlaworks K2 security vulnerability


summary: K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.


summary: The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.

title: Joomlaworks K2 security vulnerability


summary: The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.

title: Joomlaworks K2 security vulnerability


summary: The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server's context.

title: Joomlaworks K2 security vulnerability


product: Joomla! CMS

product: joomla!

summary: An improper access check allows privileged users to overwrite media files without editing permissions.


description: CVE-2026-48948 lets callers download inaccessible com_contact vCard exports. GHSA names no version range and no floor. Do not invent a Joomla tag.

title: CVE-2026-48948: Joomla com_contact vCard, No Named Floor

summary: An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.


summary: Lack of validation leads to an XSS vulnerability in the MFA management views.


summary: Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.


summary: Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.


summary: Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.


summary: Lack of escaping leads to an XSS vulnerability in the generic image output layout.


status: Undergoing Analysis

summary: Improper validation leads to a generic XSS vector in the language override feature.


summary: An improper access check allows unauthorized users to access workflow stage and transition information.


summary: An improper access check allows users to display a list of modules in the frontend.


description: CVE-2026-48957 lets unauthorized users read com_privacy datasets. GHSA names no version range and no floor. Do not invent a Joomla tag.

title: CVE-2026-48957: Joomla com_privacy Dataset, No Named Floor

summary: An improper access check allows unauthorized users to access com_privacy datasets.


description: CVE-2026-48958 lets unauthorized users create custom fields through webservices. GHSA names no version range and no floor. Do not invent a Joomla tag.

title: CVE-2026-48958: Joomla Custom Field Webservice, No Named Floor

summary: An improper access check allows unauthorized users to create custom fields via webservices endpoints.


vendor: PMQS

summary: IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.


summary: IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.

title: Pmqs Io::Compress security vulnerability


product: Red Hat Enterprise Linux 7 Extended Lifecycle Support

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

description: CVE-2026-48962 lets an attacker-controlled File::GlobMapper output glob run code in Perl IO::Compress before 2.220. Upgrade to 2.220+.

title: CVE-2026-48962: IO::Compress GlobMapper Output Glob

summary: IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.


vendor: ELEXtensions

ecosystem: php/wordpress

summary: Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.


product: XCloner

vendor: watchful

summary: Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.


product: Funnel Builder by FunnelKit

vendor: FunnelKit

summary: Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.


product: Geo Mashup

vendor: Dylan Kuhn

summary: Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.


product: Master Slider

vendor: Averta

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows DOM-Based XSS. This issue affects Master Slider: from n/a through 3.10.8.

title: Averta Master Slider security vulnerability


product: Really Simple SSL

vendor: Really Simple Plugins B.V.

summary: Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.


vendor: Really Simple Plugins

summary: Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.


product: Product Import Export for WooCommerce

vendor: WebToffee

summary: Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6.

title: Webtoffee Product Import Export For Woocommerce security vulnerability


product: SeedProd Pro

vendor: SeedProd LLC

summary: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeedProd LLC SeedProd Pro allows PHP Local File Inclusion. This issue affects SeedProd Pro: from n/a before 6.19.5.

title: Seedprod Llc Seedprod Pro security vulnerability


product: SVG Support

vendor: Benbodhi

summary: Missing Authorization vulnerability in Benbodhi SVG Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SVG Support: from n/a through 2.5.14.


product: php-standard-library

vendor: php-standard-library

description: CVE-2026-48979 is PHP h2 missing content-length smuggling. GHAD names 6.1.2 and 6.2.1. Leftover dump text named those floors.

title: CVE-2026-48979: PHP Standard Library h2 HTTP/2 missing content-length smuggling

summary: PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.


vendor: mcdope

summary: pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2.


archetype: xxe

summary: pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE), potentially making outbound network connections or local file reads at XML parse time from the context of the authenticating process. The vulnerability requires the configuration file to contain crafted XML entity references. Since pam_usb.conf is root-owned, direct exploitation requires prior write access to the config, but the defence-in-depth impact is significant given that pam_usb.so runs in setuid contexts (sudo, su). This issue has been fixed in version 0.9.2.


summary: pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary file is created using open() without the O_EXCL flag. Without O_EXCL, the create operation is not atomic: two concurrent processes racing to update the same pad may both succeed in opening the file, with the second write silently overwriting the first. The one-time pad is the core replay-prevention mechanism of pam_usb. A successful race could result in the stored pad value diverging from what either process expected, potentially causing authentication failures or, in a precisely timed attack, creating a window for pad reuse. This issue has been fixed in version 0.9.2.


summary: pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2.


summary: pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper in calls free() without first zeroing the buffer contents, releasing heap-allocated buffers containing sensitive data — including one-time pad bytes read from disk — without clearing, leaving the sensitive content in freed heap memory until it happens to be overwritten by a subsequent allocation. On a system where a use-after-free condition exists, or where a heap inspection primitive becomes available, this could allow recovery of pad values or other authentication material from freed memory regions. This is a defence-in-depth requirement consistent with prior hardening work in this codebase (GHSA-vx6f-rrqr-j87c applied explicit_bzero to some pad paths; this issue generalises the pattern to the central deallocation helper).


summary: pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.


summary: pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.


product: markdown-it

vendor: markdown-it

summary: markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.

title: markdown-it is a Markdown parser


product: Windows-MCP

vendor: CursorTouch

ecosystem: windows/system

description: CVE-2026-48989 exposes unauthenticated Windows-MCP HTTP PowerShell tools with wildcard CORS before 0.7.5. Upgrade windows-mcp to 0.7.5+.

title: CVE-2026-48989: Windows-MCP HTTP PowerShell Auth Bypass

summary: Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.


product: joserfc

vendor: authlib

ecosystem: python/pypi

summary: joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.


product: XianYuLauncher

vendor: XianYuLauncher

ecosystem: java/maven

summary: XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation. Exploitation is most likely to occur when an attacker is able to observe, intercept, or otherwise interfere with the local authentication flow on the same device. This issue has been fixed in version 1.5.5.


product: ImageMagick

vendor: ImageMagick

product: imagemagick

vendor: imagemagick

summary: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.


product: pnpm

vendor: pnpm

description: CVE-2026-48995 is pnpm malicious codeload. GHAD names 10.33.4 and 11.0.7. Earlier leftovers floor at 10.26.0 and 10.34.4 / 11.8.0.

title: CVE-2026-48995: pnpm malicious codeload.github.com

summary: pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and install these dependencies. This vulnerability is fixed in 10.33.4 and 11.0.7.

title: pnpm is a package manager


summary: e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6.


vendor: guzzle

vendor: guzzlephp

summary: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available.


product: ZXUniPOS NDS-LTE

vendor: ZTE

summary: Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can thereby steal user cookies, hijack session privileges, and tamper with page content.Since the malicious code is stored within the system, the attack scope is broad and the concealment is strong, making it frequently employed for data theft attacks.

title: Zte Zxunipos Nds-Lte security vulnerability