Lundi 15 juin 2026

info@welcart Welcart e-Commerce

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

FolioVision FV Flowplayer Video Player

Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

WP Engine WP Migrate Lite

Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.

watchful XCloner

Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.

Ahmad JS Help Desk

Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.

Ahmad WP Job Portal

Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.

Bootstrapped Ventures Visual Link Preview

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.

King Addons for Elementor

Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

juice-shop multi-juicer

MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint (POST /multi-juicer/api/teams/{team}/join) accepted requests with any Content-Type, including text/plain. Because that content type does not trigger a CORS preflight, an attacker could host a cross-site HTML form that auto-submits to the endpoint and forces a victim's browser to log in as the attacker's team. A successful, undetected attacker can cause victims to unwittingly solve Juice Shop challenges under the attacker's team identity. In a CTF context this lets the attacker inflate their team's score using other players' activity, and any sensitive data the victim enters into "their" Juice Shop ends up in the attacker's instance. The vulnerability is exploitable without any prior authentication; the victim only needs to visit a page the attacker controls while having network access to the MultiJuicer deployment. SameSite=Strict on the session cookie does not mitigate this, because the attack plants a new cookie rather than relying on an existing one. This issue was fixed in version 10.0.1.

mra13 / Team Tips and Tricks HQ Stripe Payments

Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.

ThemeGrill Masteriyo - LMS

Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

WP Chill Modula Image Gallery

Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

wp.insider Simple Membership

Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.

Liquid Web / StellarWP Event Tickets

Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

Wasiliy Strecker Contest Gallery

Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.

Nasir Ahmed Advanced Form Integration

Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

Wasiliy Strecker Contest Gallery

Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.

Wasiliy Strecker Contest Gallery

Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.

WPManageNinja Best Payments Plugin for WP

Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.

Mamunur Rashid Classified Listing

Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.

Mamunur Rashid Classified Listing

Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

Themeisle WP Full Stripe Free

Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.

properfraction ProfilePress

Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

RelyWP Simple Cloudflare Turnstile

Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.

ollybach WPPizza

Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.

TMS Amelia

Subscriber Broken Access Control in Amelia <= 2.2 versions.

myCred

Subscriber Broken Access Control in myCred <= 3.0.3 versions.

Groundhogg

Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

Iqonic Design KiviCare

Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.

VeronaLabs WP SMS

Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.

Greg Winiarski WPAdverts

Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.

rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.

Themeum Tutor LMS

Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

Themefic Ultra Addons for WPForms

Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.

Webful Creations RepairBuddy

Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.

Amit Mittal Shipment Tracker for Woocommerce

Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.

sc Internet Vivoo WpStream

Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.

Booking Activities Team Booking Activities

Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

StylemixThemes Motors

Subscriber Broken Access Control in Motors < 1.4.107 versions.

artbees JupiterX Core

Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.

WP Chill Download Monitor

Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.

eLightUp Meta Box – WordPress Custom Fields Framework

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.

jgwhite33 WP Google Review Slider

Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.

Rank Math SEO

Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.

WPDeveloper Essential Addons for Elementor

Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

myCred Bookify

Subscriber Broken Access Control in Bookify <= 1.1.1 versions.

bunny.net

Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.

vynnus PopAd

Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.

Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.

Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.

Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS private key material via a crafted GET request.

A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Discuz! X5.0

Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a crafted request or payload.

Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.

An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature.

PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module.

AWS Kiro IDE

Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

Gpac gpac

A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Gpac gpac

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).

Gpac gpac

A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

The Document Foundation LibreOffice

LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.

The Document Foundation LibreOffice

LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.

The Document Foundation LibreOffice

LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.

The Document Foundation LibreOffice

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. In fixed versions the blend-point count is checked against the data actually available before allocating.

The Document Foundation LibreOffice

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer. In fixed versions such oversized polylines are rejected.

valhalla

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting (XSS) due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the HTTP response body with Content-Type: application/javascript, without any validation, output encoding, or allowlist filtering. An attacker can craft a URL containing arbitrary JavaScript in the callback parameter; if a victim is induced to load that URL via a <script src="..."> tag, the injected script executes in the context of the serving origin, potentially leading to session token theft, credential disclosure, or actions performed on behalf of the victim. This issue was not fixed at time of publication.

Cisco Catalyst SD-WAN Manager

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

webpack-dev-server · Webpack.js webpack-dev-server

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

Mattermost · Mattermost mattermost desktop

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652