Vuldb Updates

A vulnerability, which was classified as problematic, has been found in Coturn up to 4.12.x. The affected element is the function ioa_addr_is_loopback of the component IPv6 Handler. This manipulation of the argument XOR-PEER-ADDRESS causes infinite loop. This vulnerability is handled as CVE-2026-53450. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as problematic has been found in Drupal up to 10.2.10/10.3.8/11.0.7. The impacted element is an unknown function. This manipulation causes cross site scripting. This vulnerability appears as CVE-2024-12393. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in yhirose cpp-httplib up to 0.46.x. This impacts an unknown function of the component HTTPS mode. Such manipulation leads to improper certificate validation. This vulnerability is referenced as CVE-2026-54919. It is possible to launch the attack remotely. No exploit is available.

A vulnerability has been found in h2o and classified as problematic. This impacts the function alloca of the file lib/http3/qpack.c of the component QPACK Handler. The manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2026-55213. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Apache Log4j API up to 2.25.4/2.26.0. Affected is the function MapMessage.asJson of the component MapMessage. The manipulation leads to encoding error. This vulnerability is documented as CVE-2026-49844. The attack can be initiated remotely. There is not any exploit available.

A vulnerability marked as critical has been reported in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/AdvSetMacMtuWan. The manipulation of the argument wanSpeed leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-51846. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability classified as problematic was found in Wikimedia MediaWiki up to 1.45.x. Affected is an unknown function of the file resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-58031. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in Wikimedia MediaWiki up to 1.45.x. Affected by this vulnerability is an unknown functionality of the file resources/src/MediaWiki.Special.Block/SpecialBlock.Vue. The manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-58035. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Wikimedia CheckUser up to 1.45.x and classified as problematic. This vulnerability affects unknown code of the file /components/blockConnectedTempAccountsField. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-58034. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Wikimedia UrlShortener up to 1.46.0/1.45.4/1.44.6/1.43.9. It has been classified as critical. The impacted element is an unknown function. The manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-13706. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability identified as problematic has been detected in Wikimedia MediaWiki up to 1.45.x/1.45.3/1.44.5/1.43.8. Affected by this vulnerability is an unknown functionality of the file includes/Api/ApiUserrights.Php. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2026-58024. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability described as problematic has been identified in Wikimedia AbuseFilter up to 1.45.x/1.45.3/1.44.5/1.43.8. This vulnerability affects unknown code of the file includes/Api/QueryAbuseFilters.Php. The manipulation results in information disclosure. This vulnerability is identified as CVE-2026-58027. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability classified as critical has been found in Wikimedia MediaWiki up to 1.45.x/1.45.3/1.44.5/1.43.8. This issue affects some unknown processing of the file includes/Api/ApiChangeAuthenticationData.Php,. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2026-58029. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Wikimedia CentralAuth up to 1.45.x/1.45.3/1.44.5/1.43.8. This affects an unknown function of the file includes/Api/ApiFormatBase.Php. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2026-58028. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability labeled as problematic has been found in Angular up to 18.2.14/19.2.24/20.3.23/21.2.15. This impacts an unknown function of the component Unicode Character Handler. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-50555. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability has been found in ImageMagick up to 6.9.13-50/7.1.2-25 and classified as problematic. This issue affects some unknown processing of the component MNG Decoder. The manipulation leads to uninitialized resource. This vulnerability is referenced as CVE-2026-53467. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability was found in ImageMagick up to 6.9.13-50/7.1.2-25. It has been declared as critical. The impacted element is an unknown function. Such manipulation leads to use after free. This vulnerability is listed as CVE-2026-55510. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in ImageMagick up to 6.9.13-50/7.1.2-25. Affected by this issue is some unknown functionality of the component XCF Decoder. Such manipulation leads to integer overflow. This vulnerability is uniquely identified as CVE-2026-53466. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability marked as problematic has been reported in GNU gzip up to 1.14. This issue affects some unknown processing of the component LZH Decoder. The manipulation leads to buffer over-read. This vulnerability is traded as CVE-2026-41992. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

A vulnerability classified as critical was found in ImageMagick up to 6.9.13-47/7.1.2-23. The impacted element is an unknown function of the component File Parser. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-49219. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.