Vulnerabilities

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.21.0 and prior to version 4.11.0, the ARM Crypto Extensions accelerated SHA-3 implementation has an off-by-one error that can cause a massive heap overflow that corrupts all TEE kernel memory following the hash state. This affects all platforms built with `CFG_CRYPTO_WITH_CE82=y` (ARMv8.2+ with SHA3 Crypto Extensions). Version 4.11.0 contains a patch. As a workaround, disable SHA3 Crypto Extensions with `CFG_CRYPTO_WITH_CE82=n`.

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel<br /> <br /> Versions Affected:<br />   before 3.0.0-M4 (libsvm document categorization module; introduced in<br />   OPENNLP-1808 and only present on the 3.x line)<br /> <br /> Description:<br /> SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled<br /> stream with java.io.ObjectInputStream and calls readObject() without an<br /> ObjectInputFilter installed. ObjectInputStream materialises every class<br /> referenced in the stream before the resulting object is cast to<br /> SvmDoccatModel, so the cast that follows readObject() executes only<br /> after the foreign object graph has already been deserialised in full.<br /> <br /> If a Java deserialization gadget chain is available on the consumer&amp;#39;s<br /> classpath, a crafted payload supplied to<br /> deserialize() executes arbitrary code in the JVM that loads it. Apache<br /> OpenNLP itself does not ship a known gadget chain, so the realistic<br /> risk is to downstream applications that embed the libsvm module<br /> alongside vulnerable transitive dependencies. The method is public and<br /> static, so any caller can pass an untrusted stream to it directly.<br /> <br /> The practical impact is remote code execution against processes that<br /> load SvmDoccatModel instances from untrusted or semi-trusted origins.<br /> <br /> Mitigation:<br /> <br /> 3.x users should upgrade to 3.0.0-M4.<br /> <br /> Users who cannot upgrade immediately should treat all serialized<br /> SvmDoccatModel streams as untrusted input unless their provenance is<br /> verified, and should avoid invoking SvmDoccatModel.deserialize() on<br /> streams supplied by end users or fetched from third-party sources<br /> without integrity checks.

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade DrawIO for ownCloud 10 to version 1.0.2 or later to receive a patch.

An authentication bypass vulnerability exists in<br /> the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass<br /> security controls and gain unauthorized access to the underlying filesystem.<br /> Successful exploitation could allow an attacker to read or modify system files.

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.