MariaDB: Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path

A heap out-of-bounds read vulnerability was identified in the connector library when processing binary result sets. The vulnerability occurred because the buffer for each result column was sized based on the server-declared column length, but then the actual field length reported by the server in...

MariaDB: Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket

MariaDB Connector/J was found to have an unbounded result-set field-count allocation vulnerability. When parsing result-set responses, the driver read the column count directly from the wire and used it to size a Java array without validation. A malicious server was able to declare an extremely...

MariaDB: Connector/ODBC: malicious server's long version string wraps size_t PrefixLen via negative _snprintf return, causing heap out-of-bounds write

A memory corruption vulnerability was discovered in the MariaDB Connector/ODBC driver. When a malicious server sent a handshake with an excessively long version string exceeding approximately 500 bytes, a custom snprintf function returned a negative value. This negative value was added to an...

WordPress: Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports

A broken authorization check in a WordCamp plugin allowed unauthenticated attackers to export a private CSV file containing organizer personally identifiable information. The vulnerability was caused by an inverted logic operator in the security gate that verified nonce validity and user...

MariaDB: r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de )

A server-controlled PBKDF2 iteration count vulnerability was discovered in the Parsec authentication plugin. The iteration value was read directly from the server response and only validated against a minimum threshold, allowing a malicious server to force excessive cryptographic computations. An...

Weblate: **Unauthenticated IDOR allows modification of payment customer billing information**

The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because th...

MariaDB: MariaDB HandlerSocket Improper Request Field-Count Validation Causes Server Crash

A vulnerability was discovered in MariaDB Server's optional HandlerSocket plugin that allowed improper validation of request field-count parameters. When processing exec requests, the plugin allocated stack memory based on a client-supplied field count before validating whether the count was...

MariaDB: MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service

A low-privilege database user was able to exhaust memory on a MariaDB server through the SFORMAT function by specifying an extremely large width parameter. The function attempted to allocate nearly 2 GB of memory before generating the return value. Multiple concurrent requests caused the database...

HackerOne: IDOR allows user to access report details via reference.json endpoint

An information disclosure vulnerability was identified in a report details endpoint that allowed unauthorized users to access private report information. Despite the endpoint returning an access-denied error response, sensitive report details were inadvertently exposed in the error message body...

8x8: connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an...

8x8: connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs

An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation...

Node.js: Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected...

MariaDB: Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read

A critical remote code execution vulnerability was discovered in MariaDB Server 13.0.2. The vulnerability chained two memory-safety bugs to allow an authenticated low-privilege user to execute arbitrary operating system commands as the database process user without requiring FILE, SUPER, or...

Rocket.Chat: DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

Vulnerability description not provided...

Vercel: Revoked deployment collaborator regains access to private comments after active collaborator interaction

A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused...

MariaDB: #mysql50# legacy alias / internal table collisions

A vulnerability was discovered in MariaDB related to the legacy mysql50 table name prefix feature. The issue involved improper encoding of table names prefixed with mysql50, which allowed attackers to create tables that collided with internal reserved filenames used by the database system and...

MariaDB: #mysql50# legacy alias / stale table cache identity mismatch

A legacy compatibility mechanism for table name prefixes in MariaDB was exploited to cause a mismatch between the table definition cache and actual table metadata. By opening a table through one spelling and replacing it through an alternative alias, the cache was poisoned with stale metadata. Th...

MariaDB: DATA / INDEX DIRECTORY Abuse

A vulnerability was identified in the DATA DIRECTORY and INDEX DIRECTORY functionality of a database system. Users with ordinary schema-level privileges were able to write arbitrary data to attacker-chosen locations by exploiting path traversal issues in how external table directories were...

MariaDB: MariaDB CLI Utility Issues

Several SQL injection vulnerabilities were discovered in MariaDB command-line utilities. The mariadb-show utility was found to execute malicious SQL queries when used with the --count and --verbose options, as table names retrieved from database queries were not properly escaped before being used...

MariaDB: `SHOW [CREATE|GRANTS] ...` / `mariadb-dump` Unescaped SQL Generation

A vulnerability was discovered in the database server where multiple SHOW commands and a dump utility generated SQL output with unescaped values derived from stored metadata. This flaw could allow attacker-controlled data stored in database objects to be output as executable SQL statements. When ...

Node.js: HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion...

Essity: Mass PII Exposure: 120,000+ Consumer Email Addresses Leaked via Author Enumeration on ████████

A WordPress loyalty program was found to expose approximately 121,000 consumer email addresses through user enumeration. The email addresses were configured as display names and became publicly visible through author archive pages, REST API endpoints, and RSS feeds. The affected pages were not...

Essity: Unauthenticated Plugin Settings Modification on Three Crocoblock/Jet Plugins

The vulnerability summary is as follows: Three Crocoblock Jet plugins were found to expose REST API endpoints that allowed unauthenticated users to modify plugin settings via POST requests without any authentication or authorization checks. The endpoints validated and parsed the POST body, then...

Essity: 29 Premium Plugin Packages with License Keys Publicly Accessible in Uploads Directory

A summary of the vulnerability found is as follows: 29 premium plugin packages with license keys were publicly accessible in the uploads directory of the WordPress media library. The packages were downloadable without authentication and contained the full plugin source code and embedded...

Node.js: Permission Model bypass with fs.realpathSync

A flaw in the Permission Model filesystem enforcement left fs.realpathSync without required read permission checks. This was an incomplete fix of a previous vulnerability that only covered fs.realpathSync.native. Code running under permission restrictions with limited filesystem read access was...

Node.js: Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`

A flaw in Node.js Permission Model enforcement was discovered that allowed traceevents.createTracing.enable to write trace logs outside of the --allow-fs-write setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x...

8x8: JaaS SIP Gateway Authorization Bypass

The JaaS SIP gateway endpoint was validated without verifying the tenant's provisioned entitlements. This allowed tenants to place outbound SIP calls regardless of their subscription level. The issue was promptly addressed by implementing server-side entitlement checks to ensure proper...

MariaDB: Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write

A privilege enforcement vulnerability was discovered in file user-defined functions UDFs of a database engine. The file UDFs failed to enforce FILE privilege requirements and secure file path restrictions that were already implemented in the file-backed table handler. This allowed users with only...

Node.js: Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

A flaw was discovered in the Node.js HTTP/2 implementation that allowed the nghttp2sessionmemsend function to be called re-entrantly while nghttp2sessionmemrecv was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x...

curl: heap-use-after-free in curl_easy_cleanup() called from callback

Summary: Curlclose lib/url.c:214 calls curlmultiremovehandledata-multi, data and ignores the return value. When curleasycleanup is invoked from within a write/read/progress/header callback, multi-incallback is TRUE, so curlmultiremovehandle lib/multi.c:818-819 returns CURLMRECURSIVEAPICALL withou...

curl: libcurl upload read callbacks miss recursive API guard, allowing prohibited multi API reentry and ASAN-confirmed UAF

Summary: Several libcurl upload read callback paths invoke the application-provided CURLOPTREADFUNCTION without marking the easy handle as being inside a callback. As a result, recursive multi APIs that are correctly rejected from ordinary callbacks are accepted from these upload read callback...

curl: setopt(VERIFYPEER) from callback bypasses TLS verify on connection reuse

Summary: Curlsslconnconfigupdate overwrites conn-sslconfig.verifypeer when curleasysetoptCURLOPTSSLVERIFYPEER, ... is called, with no handshake-state guard — only ifdata-conn. Since setopt is documented as callable from callbacks setopt.c:2930, an application can connect with verifypeer=0 accepti...

curl: CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer

Summary CURLSHOPTUNSHARE can free a shared SSL session cache while another thread is starting a normal HTTPS transfer with the same share handle. The failing transfer reaches the cache through curleasyperform, during the OpenSSL handshake. libcurl appears to try to reject this kind of lifetime...

Essity: Reflected XSS in legacy CGI script /cgi-bin/████████.pl on ████████ via `████████` parameter

A legacy Perl CGI script on the target website was found to reflect user-supplied input from the ████████ parameter directly into the HTML response without output encoding. This allowed unauthenticated reflected cross-site scripting XSS via both GET and POST requests...

Yelp: Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption

A debug deep link was discovered in the Android application "com.yelp.android.biz" that could be triggered externally, causing the application to crash and the user's session to be invalidated, requiring the user to log in again. The existence of this exposed deep link allowed any malicious...

Equifax-vdp: PII Exposure of Credit Applications and Social Security Numbers equifax-6070.my.salesforce-sites.com (Salesforce guest user)

A Salesforce community portal belonging to Equifax was found to be leaking tens of thousands of credit reports and other sensitive financial information. The portal's Salesforce guest user profile and sharing settings granted unauthenticated access to multiple objects, including Contact,...

Rocket.Chat: Authentication Bypass via XML Signature Wrapping in SAML SSO

The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the samlp:Response or saml:Assertion. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP...

curl: ssh_config_matches is dead code: unauthorized SSH key reuse

Summary libcurl's SSH connection-reuse guard sshconfigmatches — added for CVE-2022-27782 and reaffirmed by CVE-2023-27538 — is dead code in every release since 7.83.1. It compares sshc-rsa / sshc-rsapub between a new transfer "needle" and a pooled connection, but on both sides those pointers are...

curl: mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0

Summary When an application sets CURLOPTSSLVERIFYPEER=0 while keeping CURLOPTSSLVERIFYHOST=2 the default, the mbedTLS, wolfSSL, and rustls TLS backends silently skip the hostname-vs-certificate check. The OpenSSL, GnuTLS, and Schannel backends correctly preserve hostname checking under the same...

Weblate: API token sent to URL dictated by an untrusted project .weblate file

A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved...

Node.js: Null Dereference in X509ToObject

A null pointer dereference vulnerability was identified in X.509 certificate handling. The vulnerability could cause a process to crash when converting a specially crafted certificate to a JavaScript object. This vulnerability affected Node.js versions 24.x and 26.x...

curl: UAF read in mev_pollset_diff() trace path after curl_easy_pause() in socket callback

Summary: The CVE-2026-9080 fix re-fetches the shentry after the socket callback inside mevshentryupdate, because curleasypause called from that callback re-enters mevassess and can free the entry. The same re-fetch was not applied at the caller, mevpollsetdiff, which dereferences its own entry...

curl: Use-after-free in `mev_forget_socket` when `curl_easy_pause()` is called from a `CURL_POLL_REMOVE` socket callback (incomplete fix of CVE-2026-9080)

Summary libcurl's event interface lets the application's socket callback CURLMOPTSOCKETFUNCTION call curleasypause. CVE-2026-9080 was issued for a use-after-free that this triggers, and the fix added a post-callback re-fetch of the socket-hash entry in the UPDATE leg mevshentryupdate,...

curl: CURLOPT_HAPROXY_CLIENT_IP lacks input validation, enabling HAProxy PROXY protocol injection

Summary The CURLOPTHAPROXYCLIENTIP option accepts an arbitrary string without validating that it is a valid IP address, and without stripping special characters such as \r\n CRLF or spaces. Because this value is embedded directly into the HAProxy PROXY protocol v1 header line, an attacker who can...

curl: CVE-2026-13608: OpenLDAP SASL authentication bypass

A vulnerability was discovered in the OpenLDAP SASL authentication mechanism in libcurl. The vulnerability could allow a malicious LDAP server to bypass SASL authentication, potentially allowing the injection of arbitrary LDAP results. The vulnerable code has been present since the OpenLDAP SASL...

Monero: Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution...

Node.js: Node --run POSIX positional argument escaping allows shell command injection

Summary Node.js node --run -- attempts to append positional arguments to a package script after escaping each argument for the shell. On POSIX platforms, the escaping logic handles single quotes incorrectly. A positional argument containing a single quote can break out of the intended quoted...

Node.js: HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates

A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x...

Monero: Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM

Monero's IPv6 connection tracking used individual /128 addresses, which allowed the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermined the intended connection restrictions for IPv6 clients and was resolved in version 0.18.5.3...

Node.js: Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths

A flaw was found in the Node.js Permission Model enforcement that allowed the process.report function to write and overwrite files outside the --allow-fs-write paths...