OpenDocMan versions 2.4.0 through 2.10.0 have a decompression bomb vulnerability that allows authenticated users to upload crafted office documents (ODT, DOCX, XLSX) which decompress to very large sizes, exhausting PHP memory and causing crashes. This leads to degraded availability of the application.
Traccar versions 5.7 through 6.16.0 have a cross-site request forgery (CSRF) vulnerability due to improper validation of the OAuth state parameter in the OpenID Connect callback. This flaw allows attackers to log victims into attacker-controlled accounts by tricking their browsers into loading a malicious authorization code. As a result, data entered by victims, such as registered devices, can be associated with the attacker's account.
Traccar versions through 6.16.0 have a vulnerability in the password recovery process where reset tokens can be reused as session credentials. This occurs because the TokenManager does not bind tokens to a specific purpose, allowing attackers with a leaked reset link to gain full session access or change passwords. The attacker can maintain access for seven days even after the victim resets their password.
Sylius versions through 2.3.0 have an authorization bypass vulnerability that allows unauthenticated attackers to access unmoderated and rejected product reviews. This occurs because the AcceptedExtension filter is not applied to the item operation, enabling attackers to enumerate sequential review IDs via the API endpoint /api/v2/shop/product-reviews/{id}. Attackers can retrieve review titles, ratings, comments, timestamps, and author first names, bypassing merchant moderation controls.
phpIPAM versions up to 1.8.3 have a missing authorization vulnerability that allows authenticated users with low privileges to view restricted subnet and address information. This occurs because certain pages (customer, location, and NAT) do not enforce permission checks properly, exposing IP addresses, CIDRs, hostnames, and MAC addresses from restricted sections.
A medium-severity vulnerability (CVE-2026-108578) was identified in the Neterbit NW-431F 20250715 device. The flaw exists in an unknown function related to the /sms.json file within the Embedded Web Server component. This vulnerability allows remote attackers to cause information disclosure. The vendor has not responded to disclosure attempts, and no patch or remediation guidance is currently available.
SuiteCRM versions through 7.15.2 and 8.x through 8.10.2 have a missing authorization vulnerability. This flaw allows authenticated users, including those with low privileges who are normally denied Campaigns access, to create and modify EmailMarketing records. Exploitation occurs via the setCampaignMarketingAndTemplate entry point, enabling unauthorized reattachment of marketing messages or swapping of email templates used in campaign emails.
SuiteCRM versions through 7.15.2 and 8.10.2 have a missing authorization vulnerability in the DetailUserRole entry point. This flaw allows authenticated non-admin users to view other users' access control list (ACL) data by supplying another user's ID. The vulnerability exposes assigned roles and per-module ACL action matrices of other non-admin users. The CVSS score is 4.3, indicating a medium severity issue.
LibreNMS versions through 26.9.1.1 have an authorization bypass vulnerability in the SmokePing graph authorization logic. The flaw occurs because the code checks the source probe device rather than the actual target device, allowing restricted users on a probe device to access latency graphs for arbitrary devices. This enables unauthorized viewing of latency data and enumeration of device names.
CVE-2026-107761 is a medium severity vulnerability in GitroomHQ's postiz-app where certain API endpoints expose sensitive data unnecessarily. The channel delete endpoint returns deleted integration rows including platform access and refresh tokens, allowing authorized third-party OAuth apps to misuse social platform credentials. The user organizations endpoint exposes organization API keys to all members, not just admins, enabling unauthorized API calls on behalf of the organization. Access to these endpoints requires valid authentication and is limited to the caller's own organization, preventing anonymous or cross-tenant access.
pH7Builder versions prior to 18.6.0 contain a hard-coded API key vulnerability in Tool.class.php. This flaw allows unauthenticated attackers to bypass API access controls by spoofing the Host header and using a default private API key. Exploitation can lead to unauthorized retrieval of sensitive member information including emails, IP addresses, phone numbers, and bank account details.
pH7Builder versions before 18.5.0 have an information disclosure vulnerability where API endpoints return unfiltered user data. Attackers with a valid private API key can access sensitive information including bcrypt password hashes, non-expiring reset tokens, and TOTP secrets, enabling account takeover and bypass of two-factor authentication.
pH7Builder versions before 19.3.0 contain a CAPTCHA bypass vulnerability that allows unauthenticated attackers to bypass form validation by manipulating form IDs. This enables attackers to submit forms such as contact, comment, forum, invite, or signup without completing CAPTCHA verification, potentially automating abuse.
pH7Builder versions prior to 18.5.0 contain a path traversal vulnerability in the picture module's deletePhoto() action. Authenticated users can exploit this flaw by supplying '../' sequences in the picture_link parameter to delete arbitrary files, including other users' photos and configuration or cache files. This can lead to content loss and denial of service.
CVE-2026-108684 is a medium severity SQL injection vulnerability in erzhongxmu Jeewms affecting versions 3.0 through 3.7. The flaw exists in the getTreeData function of the Autocomplete Data Handler component, specifically in the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java. An attacker can remotely manipulate the searchVal argument to execute SQL injection. A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is available to fix this issue.
CVE-2026-108683 is a medium severity vulnerability in zhayujie CowAgent up to version 2.1.9. It involves uncontrolled memory allocation in an unknown function within the Media Download Handler component. The vulnerability can be exploited remotely without user interaction or privileges. Public exploit details have been disclosed. Upgrading to version 2.2.0 resolves the issue.
A malware infection at Nippon Columbia, a contractor of Daiichi Kosho, led to the exposure of over 8.7 million customer and employee records related to karaoke fans. The incident involves unauthorized access to sensitive personal data due to malware compromise.
MSPEP v6 is a newly published encryption system that leverages multiple physical device sensors to generate a continuous hardware-rooted entropy pool. It uses random subsets of sensors and cryptographic extractors to produce secure keys and supports applications such as storage encryption, physical timestamping, distributed consensus, and AI session security. The system is released as a defensive publication under a CC0 license, making it freely available without patent restrictions. No vulnerabilities or exploits are described in the publication.
CVE-2026-108682 is a denial of service vulnerability in zhayujie CowAgent versions 2.1.0 through 2.1.6. The issue arises from the read function of the /upload file in the Web Console component, which can be exploited remotely. The vendor has not responded to the disclosure, and no patch or fix has been confirmed. The vulnerability has a medium severity with a CVSS score of 5.3. Public exploit code is available, but no active exploitation in the wild has been reported.
The npm package @coopeuch/core version 1.999.999 contains malicious code that executes automatically upon installation. This code collects extensive host and environment information, including system identifiers, network details, and private project metadata, and sends this data to an external server without user consent. The package uses a dependency confusion technique by adopting a high version number to override internal scoped packages. This behavior constitutes unauthorized data exfiltration during package installation.