Pillow buffer error vulnerability

Versions of Pillow prior to 13.0.0 have a buffer error vulnerability. This vulnerability arises from the FlashPix JPEG-tile decoder, which, when processing specially crafted OLE2 FlashPix files, fails to recognize the JPEG mode and instead decodes it as a four-component JCSUNKNOWN. As a result,...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

IBM MQ Operator deserialization injection vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0 through 3.8.1, 3.9.0 through 3.9.2, and 4.0.0 through 4.0.4 have a deserialization injection...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Pillow Resource Management Error Vulnerability

Pillow versions from 11.3.0 to 13.0.0 contain a resource management vulnerability. This vulnerability arises when the application saves TIFF tags affected by attackers to BytesIO. During the ImagingLibTiffEncode encoding process, libtiff refuses to save the tags. The error path releases the outpu...

CVE-2026-78497

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

CVE-2026-112005

WhoDB versions 0.104.0 before 0.135.0 are vulnerable to a path traversal flaw within the DuckDB query editor . This vulnerability allows remote attackers to execute DuckDB filesystem functions, enabling them to read and write arbitrary host files . Specifically, attackers can access the session.k...

EUVD-2026-103450

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

CVE-2026-78497 JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

CVE-2026-78497 JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

CVE-2026-78497 JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

CVE-2026-78497

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a "qr'...'" literal and compiled as source text, so a "? ... " code block in i...

CVE-2026-78497

JQ::Lite versions prior to 2.51 for Perl are vulnerable to arbitrary code execution. The root cause is that patterns provided to functions like test(), match(), and the match or =~ conditions of select() are placed in a qr'...' literal and compiled as source text. This allows a (?{ ... }) code bl...

Exploit for CVE-2025-6440

Cyp1337 — CVE-2025-6440 WCDP Mass Exploit ---...

CVE-2026-110976

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type,...

CVE-2026-110976

The AI Engine WordPress plugin (versions prior to 3.7.9 ) contains a missing authorization vulnerability in its media actions. The plugin fails to verify if an item belongs to the requesting user before converting it to an attachment and permanently deleting it. This flaw allows users with the Ed...

CVE-2026-110976 AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type,...

CVE-2026-111041 AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including...