Vulnerabilities

The Address Delete controller in Mageplaza's GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 lacks an authorization check: it extends Magento's legacy Action class rather than AbstractAccount, so requests are not required to be authenticated, to belong to the address owner, or to carry a valid form key. An unauthenticated remote attacker can delete any customer's saved address by sending a GET request to /customer/address/delete/id/{id} with an arbitrary address ID. By iterating address IDs, the attacker can erase every stored customer address on the affected store; the impact is to data integrity only (CVSS C:N/I:H/A:N), with no data exposure or code execution. Any Magento 2 store running the affected Mageplaza GDPR module is exposed, with impact concentrated in loss of saved customer address records rather than site takeover. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known.

Do: Check the installed mageplaza/module-gdpr version and upgrade to a release newer than 4.2.9 as soon as Mageplaza publishes a patched version. As an interim mitigation, block or require authentication for GET requests to /customer/address/delete/id/ at the web server or WAF level, and review access logs for unauthenticated hits to that endpoint to detect any address deletion already performed.

CVE-2026-79323 is an information disclosure flaw (CWE-200) in the blogComments GraphQL query of the Magefan Blog GraphQL extension (magefan/module-blog-graph-ql) for Magento 2. A remote, unauthenticated attacker can send a POST request to the store's /graphql endpoint invoking the blogComments query, which returns more data than it should. The attacker gains blog commenters' email addresses along with internal customer and admin account identifiers, with no privileges or user interaction required (CVSS 3.1: 7.5, high confidentiality impact). Any Magento 2 store running this module in version 2.2.1 or earlier is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of publication.

Do: Update magefan/module-blog-graph-ql to the first patched release after 2.2.1 (check Magefan's changelog) and deploy it with a standard composer update and cache flush. As an interim mitigation, restrict or disable unauthenticated access to the blogComments GraphQL query (e.g., via GraphQL introspection/field controls or edge rules) so commenter email addresses are not returned. Review web logs for unauthenticated POSTs to /graphql invoking blogComments and consider notifying commenters whose email addresses may have been exposed.

CVE-2026-79322 is an unauthenticated SQL injection (CWE-89) in the RelatedProduct block of Mageplaza Blog for Magento 2, affecting all versions through 4.3.2. A remote attacker can trigger it by sending a crafted id parameter to the /mpblog/post/view route, with no authentication or user interaction required. Successful exploitation permits execution of arbitrary SQL commands and reading of arbitrary database contents, which typically includes sensitive Magento data such as customer records, orders, and admin credentials, with limited additional integrity and availability impact per the CVSS vector. Any Magento 2 store running the Mageplaza Blog extension at version 4.3.2 or older, with blog routes reachable by unauthenticated visitors, is affected. The flaw is not currently in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Upgrade the Mageplaza Blog extension to the latest release, i.e., any version newer than 4.3.2, or apply the vendor patch when available. Until patched, mitigate by blocking or strictly validating the id parameter on /mpblog/post/view at the web application firewall, or by disabling the extension's blog routes. Review web and database logs for anomalous SQL activity tied to the blog route to check for prior exploitation.

An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.

A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.

A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device.

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature. _verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via "return $xml unless $xpath->exists('dsig:Signature', $assert);". The signature check and the trust anchor check that follow run only when a signature is present, so a decrypted assertion with no dsig:Signature element reaches new_from_xml unverified and its NameID and attributes are read into the assertion object. An SP's encryption certificate is published in its SAML metadata so the IdP can encrypt to it, so any party can encrypt an unsigned assertion to that certificate, wrap it in a samlp:Response, and post it to the assertion consumer service. Any caller that configures a decryption key_file, and so accepts EncryptedAssertions, takes identity fields from an assertion that no trust anchor covers, and an unauthenticated party can authenticate as an arbitrary user. Callers with no key_file configured do not decrypt and are unaffected.

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version 7.1.2-27.

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-dir, --project-dir, and --target into subprocess.Popen even though shell=False prevents shell metacharacter injection. This issue is fixed in version 1.17.1.

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.