The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.

The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.

openjpeg: heap buffer overflow in color_apply_icc_profile in bin/common/color.c

OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.

poppler: integer overflow in Parser::makeStream in Parser.cc

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

kernel: use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c

An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c.

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.

The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.

The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.

The buddyforms plugin before 2.2.8 for WordPress has SQL injection.

The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.

The anycomment plugin before 0.0.33 for WordPress has XSS.

An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap memory corruption.

An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.

An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to memory corruption.

An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.

An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.

An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates are mishandled.

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.