Unsafe reflection in amazon-redshift-jdbc-driver < 2.3.0 allows reflection injection when an attacker can influence the JDBC connection URL parameters or the AWS credentials profile handling. If a suitable class exists on the application classpath, the attacker can trigger arbitrary code execution in the application context. Upgrade to 2.3.0+ to mitigate.

MongoDB Node.js Driver connection management can return a pooled socket to the pool while prior response data is still pending, causing reply/request mismatches when optional client-side operation timeout is enabled. Remote unauthenticated app users can trigger cross-request data disclosure and incorrect results/failed ops. Affects 6.11.0

Unauthenticated RCE in WordPress core 4.7–7.1.3 via a TOCTOU race during full-package core upgrades. Predictable, web-accessible staging paths used by the upgrader allow an attacker to execute server-side code during the upgrade window. Cisa confirms active exploitation of this CVE. Upgrade to patched versions 7.1.4, 7.0.8, 6.9.11, or 4.7.39 to mitigate.

Nodemailer apps passing user-influenced addresses can be tricked into mailing attacker-chosen recipients, bypassing allow lists: CVE-2026-121424 nested comments end early, turning comment text into a recipient; CVE-2026-121425 groups end at a semicolon inside quotes or comments; CVE-2026-121426 angle addresses end at a bracket inside quoted parts, delivering to an unnamed domain. Upgrade to 10.1.4 to mitigate.

Affects rsync `

XXE in Apache Tika org.apache.tika:tika-parser-pdf-module lets attackers inject external entities via a crafted XFA inside a PDF, enabling sensitive file/data reads and outbound requests to internal/third-party hosts (SSRF). Affects Apache Tika 1.13 through 3.2.1 (incl.), including dependents like tika-app and tika-server-standard. Upgrade to 3.2.2 to mitigate.