Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability that allows authenticated users to bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This can lead to uncontrolled resource consumption by storing files larger than the configured limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of SVG files. The server relies on the file extension rather than actual content type to sanitize SVG uploads, allowing authenticated attackers to upload malicious SVG files with JavaScript payloads using non-SVG extensions. When users view these attachments inline, the embedded script executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.
Part-DB-server versions prior to 2.12.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-controlled Part names are rendered using Twig's |raw filter without proper neutralization, allowing injection of arbitrary HTML elements into the BOM validation result page. Although JavaScript execution is blocked by the Content Security Policy, attackers can still inject HTML links, forms, images, and CSS UI elements. The vulnerability is fixed in version 2.12.2.
Part-DB-server versions prior to 2.12.1 contain a hard-coded APP_SECRET value in the .env file committed to the public repository. This secret is used by the Symfony framework to sign remember-me cookies. Because the official Docker image does not override or randomize this secret at startup, an attacker who obtains it can forge authenticated sessions without credentials. This vulnerability has been fixed in version 2.12.1.
CVE-2026-54630 is a critical vulnerability in Part-DB-server prior to version 2.12.1 that allows authenticated users with default user privileges to upload .phar files to a web-accessible directory. The upload handler fails to block .phar extensions, which are executed as PHP due to the default Apache configuration routing .phar files to PHP-FPM. This leads to remote code execution as the web server user. The issue is patched in version 2.12.1.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
CVE-2026-115638 is a medium severity vulnerability in OpenStack Ironic up to version 39.0.1. It involves improper handling of highly compressed data, specifically a denial of service caused by a configdrive that expands into a very large amount of uncompressed data (a gzip bomb). This can lead to resource exhaustion and service disruption.
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation. This manipulation of the argument url_route causes open redirect. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-19678 is a high-severity server-side request forgery (SSRF) vulnerability in onPhase Forms version 11.0.14. It allows an unauthenticated remote attacker to supply a malicious URL to a publicly accessible form, enabling access to sensitive internal Apache Solr data. The vulnerability affects the unauthenticated form service component. No patch or remediation details are provided in the available data.
CVE-2026-19677 is a critical authentication bypass vulnerability in onPhase Forms version 11.0.14. It allows unauthenticated remote attackers to impersonate arbitrary tenant users, escalate privileges to TenantAdmin and Designer roles, and execute arbitrary operating system commands by manipulating registration parameters with valid tenant and user identifiers.
CVE-2026-115536 is a cross-site scripting (XSS) vulnerability in the gedelumbung HospitalManagement software affecting the simpan function in the admin routing_pages.php controller. The vulnerability allows remote attackers to inject malicious scripts via the content argument. The software uses a rolling release system, so specific affected or fixed versions are not disclosed. The issue was reported early to the project but has not yet been addressed. Public exploit code is available. The CVSS 4.0 score rates this vulnerability as medium severity.
A malicious file identified by the SHA-256 hash c38eaf2b436cefd15e73bfa0a143d996cac708c1bccc9d3ce9b371b418e85595 was observed twice on October 23, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
CVE-2026-115486 is a high severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. It involves an out-of-bounds read in the IPv6 Neighbor Discovery handler due to accessing link-layer address options at a fixed offset without verifying their presence. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses, allowing an attacker on the same network segment to poison the ARP table and redirect network traffic.
CVE-2026-115485 is a medium severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. The DHCPv6 option parser improperly calls strlen() on raw network data without verifying a NUL terminator, leading to out-of-bounds reads. This flaw can cause daemon crashes, minor heap overwrites, or corruption of the iSCSI initiator name. An attacker on the same network segment can exploit this by sending a crafted DHCPv6 Advertise message.