CVE Vulnerability Catalog

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC. The affected plugin files contained malware that could compromise a website if activated, establish persistent access, communicate with rank1cdn[.]com, and expose WordPress credentials, database credentials, API keys, and other secrets.

In aiohttp before 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can smuggle requests when an application runs without a standard wheel (e.g., with AIOHTTP_NO_EXTENSIONS) and an intermediary interprets the framing differently.

In AIOHTTP prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user accessing an untrusted subdomain may have host-only protections stripped from cookies.

In aiohttp before 3.14.4, an attacker can send an absolute-form request causing Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications using Request.scheme for security decisions can be tricked about whether the connection is encrypted.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

In aiohttp before 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can temporarily exhaust the connection pool until garbage collection resolves the connections.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

In aiohttp before 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can cause a shared cookie marked Secure to be sent with an unencrypted request.

In russh before 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails, allowing an attacker to exhaust memory and tasks.

In Mercury from 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can reach the DOM and execute when another user views the application.

IBM MQ contains a vulnerability due to improper validation of buffer sizes in MQOPEN operations. An authenticated attacker could exploit this flaw to cause a denial of service or memory corruption.

IBM MQ contains a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. An authenticated attacker could cause a denial of service or potentially execute arbitrary code.

IBM MQ contains a heap buffer overflow when processing MQPUT operations with malformed message options. An authenticated attacker could cause a denial of service or potentially execute arbitrary code.

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

A user can access any database details, such as usernames and passwords, by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication; database write and delete operations may also be possible, but this was untested.

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes it as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect these credentials when the remote logging feature is enabled.