mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
CVE-2026-102365 is a high-severity vulnerability in gz-yami mall4j up to version 4.0 where authorization checks are missing on certain GET endpoints in the UserAddrController. Authenticated attackers can access endpoints that expose customer address data, including names, phone numbers, and postal information. This allows unauthorized data harvesting of sensitive customer information.
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.
CVE-2026-102361 is a critical vulnerability in gz-yami mall4j versions up to 4.0 that allows unauthenticated attackers to reset any storefront account password via the PUT /user/updatePwd endpoint. This missing authentication flaw enables attackers to specify a target username and overwrite passwords without verification, leading to account takeover and unauthorized access to orders and personal data.
CVE-2026-101261 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects an unspecified part of the /api/ZRnetwork/firstSetup_wifi endpoint, where manipulation of the login_pwd argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands remotely without user interaction. The vendor was notified but did not respond, and an exploit has been published. No patch or remediation information is currently available.
Nginx Proxy Manager versions up to 2.16.0 contain an authorization flaw that allows non-administrator users with manage permissions to inject arbitrary nginx directives via the advanced_config field. This improper restriction can enable attackers to manipulate nginx configurations, such as serving arbitrary files or controlling routing for their assigned hosts.
Nginx Proxy Manager versions up to 2.16.0 have a critical vulnerability due to lack of rate-limiting on authentication endpoints. This allows unauthenticated attackers to perform unlimited password guessing attacks and brute-force two-factor authentication codes, potentially gaining full administrative access.
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
Dozzle versions before 11.1.2 contain a path traversal vulnerability in the log download endpoint. The issue arises because container display names are not properly sanitized when building ZIP archive entry names. This allows attackers who can label containers to craft path traversal sequences that write files outside the intended extraction directory when logs are downloaded and extracted.
CVE-2026-101092 is a medium severity vulnerability in SiYuan note-taking software versions before 3.8.4. The issue involves a failure to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing unauthorized users with publish reader access to retrieve image asset paths from databases they should not access. This can lead to exposure of sensitive image asset paths and filenames that the rendering endpoint would normally block.
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.
CVE-2024-42002 is a code injection vulnerability in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool. It affects all ROS 2 distributions from Crystal Clemmys through Lyrical Luth and Rolling Ridley. The flaw exists in the 'hz' verb, which uses the --filter option to accept a user-supplied Python expression that is passed unsanitized to the eval() function. This allows a local user to execute arbitrary code. The vulnerability has a high severity score of 8.6 (CVSS 4.0). No patch or official remediation information is provided in the available data.
Authlib versions up to and including 1.7.2 contain a signature-verification bypass vulnerability in their JSON Web Signature (JWS) handling. The vulnerability allows attackers to supply JWS objects with an empty "signatures" array, which Authlib mistakenly treats as verified without performing signature checks. This enables attackers to forge arbitrary authenticated payloads without possessing any signing keys, potentially leading to authentication bypass, privilege escalation, and message integrity compromise. No official patch is currently available, and users should monitor the project's GitHub repository for updates.
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.
CVE-2026-97027 is a vulnerability in Red Hat Enterprise Linux 10 involving improper input validation by Flatpak when exporting application Desktop Entry and D-Bus Service files. This flaw allows a malicious Flatpak application to cause denial of service conditions such as forced application restart loops or to influence host D-Bus/systemd activation behavior beyond sandbox restrictions. The vulnerability has a medium severity score and impacts availability but does not affect confidentiality or integrity.
CVE-2026-97026 is a vulnerability in Red Hat Enterprise Linux 10 where Flatpak creates temporary child repository directories with insecure world-writable permissions (0777). This can allow other local users on multi-user systems to read or modify these temporary directories during application or runtime installation. Although tampered content will fail signature or digest verification, this may cause installation failures leading to denial of service. The vulnerability has a low severity rating with a CVSS score of 3.9.
CVE-2026-97025 is a vulnerability in Red Hat Enterprise Linux 10 where Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory. This misconfiguration allows other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources are affected; libostree-based sources such as Flathub are not impacted.