Vuldb Updates

A vulnerability was found in wpovernight PDF Invoices & Packing Slips for WooCommerce Plugin up to 5.16.4 on WordPress. It has been classified as problematic. This affects the function wp_kses. The manipulation of the argument billing_address.first_name/last_name/company/customer_note leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-107750. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in WPO365 Microsoft 365 Graph Mailer Plugin up to 6.2 on WordPress. It has been declared as problematic. The affected element is an unknown function. Such manipulation of the argument Subject leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-107759. The attack can be launched remotely. No exploit exists.

A vulnerability was found in e4jvikwp VikRentCar Car Rental Management System Plugin up to 1.4.9 on WordPress. It has been rated as problematic. This issue affects some unknown processing. This manipulation of the argument poplink causes cross site scripting. The identification of this vulnerability is CVE-2026-115840. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic has been found in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. This vulnerability is uniquely identified as CVE-2026-120274. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

A vulnerability, which was classified as critical, has been found in HTTP::Session up to 0.53. This impacts an unknown function of the file lib/HTTP/Session/Store/CHI.pm of the component CHI Store. The manipulation of the argument session id leads to command injection. This vulnerability is uniquely identified as CVE-2026-13575. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability was found in Apache Wicket up to 8.19.0/9.24.0/10.11.0 and classified as critical. The impacted element is the function WebSocketResource.onPayload of the component WebSocket Handler. The manipulation results in improper authorization. This vulnerability was named CVE-2026-82115. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability was found in Apache Wicket. It has been classified as critical. This affects the function Form.onRequest of the file Form.java of the component Form Submission. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2026-82557. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability classified as critical was found in Apache Wicket up to 8.19.0/9.24.0/10.11.0. The affected element is the function onMessage of the file org/apache/wicket/protocol/ws/api/WebSocketBehavior.java of the component WebSocket Behavior. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2026-82558. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

A vulnerability has been found in VTK 9.6.1 and classified as critical. Affected by this vulnerability is the function InputGraph2 of the component vtkChacoReader. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-9535. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in phpMyAdmin up to 5.2.3 and classified as problematic. This vulnerability affects the function DesignerHistory.display of the file js/src/designer/history.js of the component Designer query mode. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2026-119563. The attack can be launched remotely. No exploit exists.

A vulnerability was found in gopacket up to 1.7.1 and classified as problematic. Affected is the function decodeSCTPInit/decodeSCTPShutdown/decodeSCTPError/decodeSCTPSack/decodeSCTPParameter of the file layers/sctp.go of the component SCTP Sub-decoder. Such manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-119299. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in FFmpeg up to 9.0.2. Affected by this vulnerability is an unknown functionality of the component IMF demuxer. Such manipulation of the argument ASSETMAP leads to path traversal. This vulnerability is uniquely identified as CVE-2026-120210. The attack can be launched remotely. No exploit exists.

A vulnerability was found in SQLite up to 3.53.x and classified as problematic. The affected element is the function selectExpander of the component Common Table Expressions. The manipulation results in uncontrolled recursion. This vulnerability is identified as CVE-2026-119371. The attack is only possible with local access. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability categorized as problematic has been discovered in OpenBSD LibreSSL up to 4.4.0. This affects the function url2host of the component ocspcheck. Executing a manipulation can lead to cleartext transmission of sensitive information. This vulnerability is handled as CVE-2026-118373. The attack can be executed remotely. There is not any exploit available.

A vulnerability labeled as problematic has been found in OpenBSD LibreSSL up to 4.4.0. Affected is the function http_head_read/http_body_read of the component ocspcheck. The manipulation results in uncontrolled memory allocation. This vulnerability was named CVE-2026-118374. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in OpenBSD LibreSSL up to 4.4.0. It has been declared as problematic. This impacts the function url2host of the component ocspcheck. Executing a manipulation can lead to crlf injection. This vulnerability appears as CVE-2026-118372. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in OpenBSD LibreSSL up to 4.4.0. It has been classified as problematic. This affects the function OCSP_sendreq_new/OCSP_parse_url. Performing a manipulation results in crlf injection. This vulnerability is reported as CVE-2026-118371. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as critical has been found in Google Chrome. This affects an unknown part of the component Metrics. Executing a manipulation can lead to use after free. This vulnerability is tracked as CVE-2026-106233. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Google Chrome. Affected by this issue is some unknown functionality of the component Network. Performing a manipulation results in use after free. This vulnerability is identified as CVE-2026-106234. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability was found in Google Chrome. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Dawn. This manipulation causes uninitialized resource. This vulnerability is tracked as CVE-2026-106231. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.