The internet is broken right now.

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

Memory safety

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.

Disclosure Server IBM Api Connect

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler's stm_user_avatar_path meta is writable by any logged-in user against their own account.

Disclosure Web app

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.

Injection Web app

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Memory safety Browser & mail

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Memory safety OS & kernel

Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.

Memory safety OS & kernel

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction.

Injection Web app

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Memory safety

Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

Disclosure Server

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Memory safety Server

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Auth & access Server

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Auth & access

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.

Injection

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Injection Server

Improper link resolution before file access ('link following') in Windows DNS allows an authorized attacker to elevate privileges over a network.

Other OS & kernel

Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.

Auth & access

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

Memory safety Server

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

Memory safety Server

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.

Disclosure

Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

Auth & access

Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

Disclosure Server

Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

Other Server

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

XSS Server

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Injection Server

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Injection Server

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Injection Server

Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Injection Server

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Injection Server

Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.

Injection Server

clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.

Denial of service

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page.

Code execution Web app

Integer underflow (wrap or wraparound) in HID Parser Library allows an authorized attacker to elevate privileges over a network.

Memory safety OS & kernel

Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.

Memory safety

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Other

Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Memory safety Server

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Auth & access Server