SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process. do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n. This issue affects bandit: from 0.3.4 before 1.14.0.

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.

WordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.

YunaiV yudao-cloud get-by-website sql injection

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.

Authentication Bypass via Alternate Channel in Fortinet FortiSandbox Allowing Unauthorized Command Execution

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

The reported issue is tracked under CVE-2026-18451. This CVE ID is rejected as a duplicate.

The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate.

The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate.

The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

Windows NTFS Remote Code Execution Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Server Update Service Elevation of Privilege Vulnerability

Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.