img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c.

audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.

AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. There is "cfg_new->AVCLevelIndication = cfg->AVCLevelIndication;" but cfg could be NULL.

The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.

The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.

The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.

The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.

openjpeg: heap buffer overflow in color_apply_icc_profile in bin/common/color.c

OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.

poppler: integer overflow in Parser::makeStream in Parser.cc

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

kernel: use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c

An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c.

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.

The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.

The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.

The buddyforms plugin before 2.2.8 for WordPress has SQL injection.

The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.