ZITADEL versions from 3.0.0 up to but not including 4.19.2 contain an authentication bypass vulnerability in the Login V2 UI. This flaw allows unauthenticated attackers to forge unsigned session cookies and guess time-ordered session IDs to obtain valid rotated session tokens. Exploitation enables attackers to take over user accounts, including those of administrators who have completed multi-factor authentication.
CVE-2026-75888 is a Server-Side Request Forgery (SSRF) vulnerability in the OpenShift console. An authenticated user can exploit this flaw by supplying a crafted Helm chart URL that is not properly validated. This causes the console pod to fetch arbitrary URLs, potentially exposing sensitive information via error messages or enabling blind port scanning within the cluster. The vulnerability has a high severity with a CVSS score of 7.7. No affected versions or patch information are currently provided.
LibreNMS versions prior to 26.9.0 contain a stored cross-site scripting (XSS) vulnerability in the wireless.inc.php file. This vulnerability arises because wireless sensor description values obtained via SNMP are echoed into HTML without proper escaping. An attacker controlling a monitored device's SNMP agent can inject malicious JavaScript code that executes when authenticated users view the Wireless tab, potentially enabling session hijacking.
LibreNMS versions before 26.9.0 contain an SQL injection vulnerability in the notifications.inc.php component. This flaw allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter. Exploitation can lead to unauthorized reading of users' password hashes across database tables, with results stored in notifications_attribs and accessible through the application interface.
LibreNMS versions before 26.9.0 have a missing authorization vulnerability in the PortsController::purge function. This flaw allows users with global-read (read-only) privileges to delete ports physically without having delete permissions. Specifically, such users can send DELETE requests to the /ports/purge endpoint with the parameter purge=all, which irreversibly deletes every deleted port on all devices visible to them.
LibreNMS versions prior to 26.9.0 have a path traversal vulnerability in the nfsen_channel_common.inc.php file. This flaw allows authenticated users to read unauthorized RRD data by injecting '../' sequences into the channel parameter. Exploiting this, attackers with access to one NFSen-enabled device can view traffic and NetFlow graphs of devices outside their authorized scope. The vulnerability has a medium severity with a CVSS score of 4.3.
LibreNMS versions before 26.9.0 have a stored cross-site scripting (XSS) vulnerability in the get_oxidized_nodes_list() function. This flaw allows unescaped rendering of Oxidized API fields and SNMP sysName values, enabling attackers who control these inputs to inject malicious scripts. Such scripts execute in the browsers of users viewing the Tools Oxidized page, potentially leading to session hijacking or other client-side impacts.
LibreNMS versions prior to 26.9.0 contain an LDAP filter injection vulnerability in ldap-authorization and ad-authorization modes. This occurs because usernames are inserted into LDAP search filters without proper escaping, and authentication only verifies user existence. If REMOTE_USER is not forwarded, unauthenticated attackers can exploit this by sending a wildcard username via HTTP Basic Authorization to match all users and groups, potentially gaining administrative access.
SurrealDB versions from 3.0.0 up to but not including 3.3.0 have a missing authentication vulnerability in the revoke RPC method. This flaw allows low-privileged or unauthenticated users to revoke other users' refresh tokens without proper proof of possession. Attackers can obtain grant identifiers through ACCESS SHOW ALL with VIEWER permission or leaked tokens, enabling them to force re-authentication by permanently revoking refresh tokens.
SurrealDB versions from 3.1.0 up to but not including 3.3.0 have an authorization bypass vulnerability. Authenticated users with delete permission on a referenced table can delete records that trigger a cascade delete, bypassing permission checks on protected graph edges. This allows deletion of edges despite explicit delete restrictions on the edge table.
SurrealDB versions prior to 3.3.0 contain a vulnerability where the SurrealQL USE statement allows authenticated users to switch sessions to any namespace or database without proper authorization checks. This flaw enables cross-tenant access, permitting users to read, create, update, or delete data in other tenants' tables if permissions allow, such as with full permissions.
SurrealDB versions 3.1.0 up to but not including 3.3.0 contain a vulnerability where Surrealism modules can exhaust server memory by buffering stdout/stderr lines without bounds. This bypasses configured memory limits, allowing an attacker with Owner privileges to run a malicious module that writes output without newlines, causing the server to crash and resulting in denial of service across all namespaces and databases.
better-auth versions from 1.3.8-beta.3 up to but not including 1.7.0-rc.3 contain a UI misrepresentation vulnerability in the deviceAuthorization plugin. This vulnerability occurs because the GET /device endpoint omits the requesting client_id and scope, allowing attackers to trick signed-in users into approving a device code. The attacker can then redeem the code for a live session token, potentially gaining unauthorized access.
SurrealDB versions before 3.3.0 have an authorization bypass vulnerability that allows users with table-level write permissions to read fields normally restricted by SELECT permissions. This is achieved by exploiting JSON Patch operations to access hidden data fields. The vulnerability can lead to unauthorized data disclosure without requiring elevated privileges beyond write access.
SurrealDB versions before 3.3.0 have an authorization bypass vulnerability that permits record users to access fields that should be hidden by field-level SELECT permissions. This occurs via LIVE SELECT projections, allowing attackers to retrieve restricted field values by projecting them from the unreduced $after or $before parameters under an alias during CREATE, UPDATE, and DELETE notifications.
SurrealDB versions before 3.3.0 have an authorization bypass vulnerability that enables record users to infer values of fields protected by field-level SELECT permissions. This is achieved by using LIVE SELECT WHERE predicates with $before or $after to observe notification behavior on record CREATE, UPDATE, or DELETE events. The vulnerability allows attackers to confirm or narrow down restricted field values without direct access.
Admidio versions 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contain a reflected cross-site scripting (XSS) vulnerability in the system/redirect.php component. This vulnerability allows unauthenticated attackers to inject JavaScript code via the url GET parameter due to an incomplete fix of a previous vulnerability (CVE-2021-43810). The attack involves crafting a javascript: URL with a decoy http:// segment that bypasses validation and executes script in the context of the Admidio origin when a victim clicks the redirect link.
SurrealDB versions from 3.0.0 up to but not including 3.3.0 contain an authorization bypass vulnerability. This flaw allows authenticated users to read records in other namespaces or databases by exploiting the FETCH operation to resolve record IDs. Attackers can switch to a foreign namespace or database and specify a known record ID in a RETURN ... FETCH query to access data belonging to other tenants if table permissions allow read access.
Admidio versions 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 have a broken access control vulnerability. This flaw allows role administrators to assign users to roles in organizations other than their own by submitting crafted requests with foreign role UUIDs. Exploiting this, attackers can gain privileged membership in other organizations, log in as those users, and modify user profiles.
Admidio versions 5.0.0 up to but not including 5.0.15 contain an unauthenticated stored cross-site scripting (XSS) vulnerability in the RegistrationPresenter.php component. This vulnerability occurs because the raw FIRST_NAME registration value is inserted into an unencoded data-message attribute. An attacker can exploit this by registering with a specially crafted input containing a double-quoted event handler, which executes JavaScript in an administrator's session when they hover over the entry on the Manage registrations page.