CVE-2026-118272 a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...

CVE-2026-118272 a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...

Allocation of Resources Without Limits or Throttling

Overview @a2ui/webcore is an A2UI Core Library Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the resolveSignal method of the DataContext class. An attacker can exhaust the memory and CPU of the client by sending an updateComponents...

kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

A flaw was found in the Linux kernel's nfnetlinkcthelper component. This vulnerability, an out-of-bounds read, occurs in the nfnlcthelperdumptable function when a network connection tracking helper is removed during a dump operation, leading to a bypassed bounds check. A local attacker could...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

A flaw was found in the Linux kernel's SCSI target subsystem. This vulnerability, a buffer overflow, occurs in the tgptgpmembersshow function when processing long iSCSI IQN names. An attacker could potentially exploit this by providing a specially crafted input, leading to the disclosure of...

kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

A flaw was found in the Linux kernel's Tegra cryptography module. An incorrect calculation in the 'tegragcmdoonereq' function, specifically when handling the 'cryptlen' parameter, can occur if a caller does not properly initialize the authentication size. This can lead to a write beyond the...

kernel: xfrm: Duplicate SPI Handling

In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRMMSGALLOCSPI Netlink message, which triggers the kernel function xfrmallocspi. This function is expected to ensure uniqueness of the Security...

kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()

A flaw was found in the Linux kernel's netfilter component, specifically within the nfnetlinkqueue module. A local attacker with low privileges could trigger a race condition by calling nfreinject without the required rcureadlock in the instancedestroyrcu function. This could lead to suspicious R...

CVE-2026-106013

The Jupiter X Core plugin for WordPress (versions

CVE-2026-106013 Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verifytwittercallback function because after exchanging the visitor's oauthverifier for their acces...

CVE-2026-106013 Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verifytwittercallback function because after exchanging the visitor's oauthverifier for their acces...

EUVD-2026-111538

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verifytwittercallback function because after exchanging the visitor's oauthverifier for their acces...

EUVD-2026-111537

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...

CVE-2026-118271 a2ui-project a2ui data-context Resolver data-context.ts resource consumption

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...

CVE-2026-118271 a2ui-project a2ui data-context Resolver data-context.ts resource consumption

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...

CVE-2026-118271 a2ui-project a2ui data-context Resolver data-context.ts resource consumption

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...

CVE-2026-118271

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...

CVE-2026-118271

The a2ui-project a2ui library (versions up to 0.10.6 ) is vulnerable to a resource consumption vulnerability via the data-context Resolver component. The issue originates from an unknown function within the file renderers/web_core/src/v0_9/rendering/data-context.ts. This flaw allows for remote ma...

kernel: xfrm: Duplicate SPI Handling

In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRMMSGALLOCSPI Netlink message, which triggers the kernel function xfrmallocspi. This function is expected to ensure uniqueness of the Security...