Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by sending commands through MCP Hub to the built-in Browser Operator extension. This issue affects Opera Neon MCP Hub extension: 0.0.1.

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only.

Privilege Escalation via Kernel Hypervisor Subcomponent

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Authenticated Injection

Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.

MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM. The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services. The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic. Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.

ibi WebFOCUS - OS Command Injection Vulnerability

Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.

URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI

In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.

WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.

Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.

Baseband Crash via Improper SIP Packet Handling

Incorrect handling of SIP packets leads to baseband crashes

Authentication Bypass

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.

SiteServer SSCMS captcha inadequate encryption

A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Microsoft Office Outlook Information Disclosure Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Microsoft Office Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Microsoft Office Excel Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Windows Input System Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Input System allows an authorized attacker to elevate privileges locally.

Windows Device Association Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Windows SMB Client Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows SMB Client allows an authorized attacker to elevate privileges locally.