Vulnerability intelligence

CVE-2026-114432 is a vulnerability affecting the Contact Form 7 WordPress plugin in versions prior to 6.2.4. The issue stems from a failure to validate the file types or extensions of files uploaded through form file fields, combined with a flaw in the plugin's temporary-file cleanup process. This combination allows unauthenticated users to upload arbitrary files and leaves them stored on the server's disk. The impact of this vulnerability depends on the server's configuration. On standard Debian or Ubuntu Apache setups that list directory contents and map `.phar` files to the PHP handler, the uploaded files can be located and executed, potentially leading to remote code execution. On other configurations, such as nginx or Apache with `.htaccess` overrides enabled, the vulnerability is limited to arbitrary files being written to the uploads directory, where they can still be served as active content like HTML or SVG from the site's origin.

CVE-2026-110963 is a security vulnerability identified in the Userplace WordPress plugin, affecting all versions up to and including 1.2.0. The issue, which was reported by WPScan, stems from the plugin's failure to perform authorization checks on an AJAX action that is accessible to unauthenticated users. Additionally, the plugin publicly exposes the security nonce that is meant to protect this specific action. Because of this flaw, unauthenticated attackers can exploit the exposed nonce to execute the AJAX action, enabling them to create a new administrator account or write arbitrary site options. This can ultimately lead to a complete takeover of the affected WordPress website. At the time of its disclosure, a patched version addressing the vulnerability had not yet been released.

CVE-2026-43499, publicly known as GhostLock, is a local privilege escalation vulnerability found within the Linux kernel. This flaw resides specifically in the `rtmutex` (real-time mutex) and Priority Inheritance (PI) futex requeue path. The core issue stems from an incorrect cleanup operation during a 'proxy-lock rollback' in the futex requeue process, where the system operates on the currently executing task instead of the true waiter task. This misdirection leaves behind stale priority-inheritance state and creates a use-after-free (UAF) condition, where the kernel attempts to use memory that has already been released. An attacker with local code execution can exploit this vulnerability to gain elevated privileges or execute unauthorized code on affected systems. The vulnerability was introduced in Linux 2.6.39 in May 2011 and affects kernels up to version 7.1.

CVE-2026-123158, nicknamed "sshole," is a password authentication bypass vulnerability affecting OpenSSH (`sshd`) on Linux systems that use the musl C library (musl libc) without Pluggable Authentication Modules (PAM). Discovered by researcher Özgün Kültekin and patched in OpenSSH version 10.6p2 on November 5, 2026, the flaw primarily impacts Alpine Linux, where this specific configuration is the default. It also potentially affects other musl-based environments such as OpenWrt, Buildroot, Yocto, and various lightweight Docker container images. The vulnerability occurs due to an unexpected interaction between OpenSSH's password validation and musl's `crypt()` function. When an attacker attempts to log in using an overlong password (typically between 257 and 1,024 bytes), the `crypt()` function fails and returns an asterisk ("*"). If the target account is passwordless and has its password field in `/etc/shadow` set to "*", OpenSSH compares the two matching values and mistakenly grants access. This allows remote attackers to log into these accounts without knowing any valid credentials, which can lead to unauthorized access and potential privilege escalation.

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.