Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'updatemetadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of...

CVE-2026-54740

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-54740 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-19025

A flaw was found in HDF5. An attacker can craft a malicious HDF5 file that, when opened and read by an application, exploits a validation bypass. This bypass, related to mismatched chunk-layout dimensionality and dataspace rank, leads to a divide-by-zero error, causing a denial of service DoS and...

CVE-2026-66702

Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...

CVE-2026-66702 WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...

EUVD-2026-53906

Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...

CVE-2026-66702

CVE-2026-66702 affects the WordPress Rank Math SEO plugin up to version 1.0.274.1 and is described as an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected documents confirm the vulnerability exists in Rank Math SEO

EUVD-2026-53686

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

Linux Distros Unpatched Vulnerability : CVE-2026-19025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank wh...

CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

DEBIAN-CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

UBUNTU-CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

CVE-2026-19025 HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

CVE-2026-19025

The CVE-2026-19025 entry concerns HDF5 versions up to 2.3.0. It describes a flaw in H5O__layout_decode within H5Olayout.c where a chunked dataset’s stored chunk-layout dimensionality is not validated against its dataspace rank when an existing dataset is opened (validation exists only at dataset ...

CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

Pillow: Pillow: Native heap out-of-bounds write

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation, and ImagingExpand computes output...

Pillow: Pillow: Native heap out-of-bounds write

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation, and ImagingExpand computes output...

EUVD-2026-52816

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to denial of service and data tampering...