What needs attention now.

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can ...

• CWE-345

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without ins...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers ca...

• Command injection

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to r...

• Other injection

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id con...

• Other injection

<1.4.9 · fixed in 1.4.9

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb comma...

• Other injection

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal c...

• CWE-116

<1.4.9 · fixed in 1.4.9

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the works...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. ...

• Weak cryptography or TLS

<1.4.9 · fixed in 1.4.9

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

• Tutor LMS
• Other injection

UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

• bytedance UI-TARS-desktop
• Authentication bypass

openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

• jahlives openssl_encrypt
• CWE-20

Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

• team-telnyx telnyx-mcp
• Authentication bypass

ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape

• mims-harvard ToolUniverse
• Code injection

mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication

• mcp-router
• Authentication bypass

Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

• Dassault Systèmes 3DSwymer
• Broken access control

Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)

• limanmys core
• Command injection
• CWE-20

Flowintel Fails to Invalidate Active Sessions After Password Change

• flowintel
• Authentication bypass

Multiple Vulnerabilities in TOOOLS' iSquad

• TOOOLS iSquad
• SQL injection

Multiple Vulnerabilities in TOOOLS' iSquad

• TOOOLS iSquad
• SQL injection

Multiple Vulnerabilities in TOOOLS' iSquad

• TOOOLS iSquad
• SQL injection

Multiple Vulnerabilities in TOOOLS' iSquad

• TOOOLS iSquad
• SQL injection

Zbtlink MQWrt infosrvd Command Injection

• Zbtlink WE1326
• Zbtlink WE2426-C
• Command injection
• Hard-coded credentials

Zbtlink MQWrt yunmgrd Cloud C2 Implant

• Zbtlink L3_V2_8
• Zbtlink WE826-T2
• CWE-300
• CWE-506

WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

• hashthemes Hash Form
• Insecure deserialization

WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability

• Jonathan de Jong Beautiful Taxonomy Filters
• SQL injection

WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability

• INFINITUM FORM Geo Controller
• Insecure deserialization

WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

• WP Manage Ninja Fluent Boards Pro
• Unrestricted file upload

WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability

• Epayco
• SQL injection

WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability

• ACPT (Pro) - Custom Post Types Plugin for WordPress
• Privilege escalation

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

• CODEPRESS IT Solutions LLC Visitor Traffic Real Time Statistics Pro
• SQL injection

Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

• VMware by Broadcom Spring Security (OAuth2 Authorization Server module)
• CWE-20

Spring Framework Improper Path Limitation in XsltView

• Path traversal

<=5.2.25.RELEASE || >=5.3.0, <=5.3.49 || >=6.0.0, <=6.0.30 || >=6.1.0, <=6.1.28 || >=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

Spring Framework Server Sent Event stream corruption while rendering fragments

• Other injection

>=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

• Broken access control

>=5.2.5.RELEASE, <=5.2.25.RELEASE || >=5.3.0, <=5.3.49 || >=6.0.0, <=6.0.30 || >=6.1.0, <=6.1.28 || >=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

• Workeera
• Path traversal

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

• joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla
• Unrestricted file upload

Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

• Spring Framework
• Denial of service

Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

• Spring Security

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.

• Code injection

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal.

• Path traversal

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.

• Broken access control

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the s…

• Privilege escalation

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.

• Information disclosure

A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.

• Path traversal

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.

• Authentication bypass

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection.

• Code injection

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0.

• CWE-20

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4.

• CWE-20

An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.e…

• CWE-494

An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml co…

• Information disclosure

KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

• 1Panel-dev KubePi
• Authentication bypass

Injection in WebPros Plesk

• WebPros Plesk
• Other injection

Authentication bypass in Veeam One

• Veeam One
• Authentication bypass

OS command injection in Dell Cloud Disaster Recovery

• Dell Cloud Disaster Recovery
• Command injection

Bucket Squatting in Vertex AI Search for Commerce

• Google Cloud Vertex AI Search for Commerce
• Weak cryptography or TLS

NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration

• vesoft-inc nebula
• Authentication bypass

ILIAS PHP Object Injection via Shibboleth Logout

• ILIAS
• Insecure deserialization

senaite.core Vulnerable to Eval Injection and Missing Authorization

• Code injection
• Broken access control

>=2.0.0, <=2.6.0 · no fixed version yet