Threat database

ERPNext versions 15.55.0 through 16.50.0 have an authorization vulnerability in the get_timesheet_html method. Authenticated portal users can access project timesheets without proper authorization checks, bypassing hide_timesheets settings and project membership requirements. This leads to unauthorized viewing of timesheet details including names, status, time-log dates, and last modifiers.

Vercel deepsec versions from 0.1.0 up to but not including 1.1.17 contain a link following vulnerability in the extractTarballLocally function. This flaw allows sandboxed code to write files outside its intended sandbox by planting symbolic or hard links in tarball results. An attacker controlling sandboxed code, such as a prompt-injected coding agent, can exploit this to write arbitrary files on the orchestrator host. The vulnerability has a CVSS 4.9 score, indicating medium severity.

CVE-2025-71429 is a critical OS command injection vulnerability in GPT-SoVITS through version 20250606v2pro. It exists in the tools/uvr5/vr.py component and allows unauthenticated attackers to execute arbitrary OS commands by injecting shell substitutions in output folder path inputs via the UVR5 WebUI when exporting mp3 or m4a files.

HoloViz Panel versions from 1.2.2 up to but not including 1.9.0 contain an open redirect vulnerability. This flaw exists in panel/auth.py where the next query parameter is not validated, allowing attackers to redirect users to external malicious sites after login. The vulnerability affects the BasicLoginHandler and PasswordLoginHandler, which store the next parameter in a cookie and redirect users accordingly. The CVSS 4.0 score is 5.1, indicating a medium severity issue.

CVE-2026-16678 is a medium severity vulnerability in IBM Virtualization Management Interface firmware versions FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81. It involves improper resource management that could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can exploit this by supplying crafted configuration data, causing the host firmware boot stack to crash and potentially corrupt memory during system initialization. This leads to integrity and availability impacts on the managed system.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can exploit this flaw by sending a specially crafted mailbox message, leading to arbitrary code execution within the host firmware runtime. This vulnerability allows full access to the managed system's memory and hardware interfaces, impacting confidentiality, integrity, and availability.

A stack-based buffer overflow vulnerability (CWE-121) exists in IBM Power Systems Firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81. The flaw is in the host firmware boot process image validation path. An attacker with service processor access can supply a malicious code update image, enabling arbitrary code execution on the host system. This can compromise confidentiality, integrity, and availability of the affected host.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can exploit this flaw by sending a specially crafted mailbox message, leading to arbitrary code execution within the host firmware runtime. This vulnerability compromises the confidentiality, integrity, and availability of the managed system by granting full access to system memory and hardware interfaces.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can send crafted mailbox messages to read or modify arbitrary Hostboot memory regions. This compromises the host firmware boot stack and the hypervisor loaded by it, impacting confidentiality, integrity, and availability of the managed system.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a stack-based buffer overflow vulnerability in the host firmware configuration parsing. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can supply crafted configuration data that causes memory corruption during the system Initial Program Load (IPL). This corruption affects the host firmware boot stack and the hypervisor loaded afterward, leading to potential compromise of confidentiality, integrity, and availability of the managed system.

0xJacky nginx-ui versions prior to 2.4.1 contain an improper authentication vulnerability (CWE-287) in the two-factor authentication enrollment endpoints. The endpoints for enrolling TOTP and WebAuthn passkeys require only a valid JWT and are not protected by a secure session middleware, allowing an attacker with a stolen JWT to bind their own second factor to a victim's account without re-authentication. This enables persistent account takeover that survives password resets and locks out legitimate users.

CVE-2026-84321 is a medium severity vulnerability in 0xJacky's nginx-ui prior to version 2.4.1 involving insufficient session expiration. Standalone short tokens used for WebSocket and explicit-token authentication remain valid in cache even after administrative revocation. If the associated user account is re-enabled before the cache entry expires, the stale short token can be reused to authenticate successfully.

NetHerman Portal del Hermano (portaldelhermano.es) before 2026-10-06 has a critical broken authentication vulnerability in its password recovery mechanism. The flaw exists in the POST /password/create-access and POST /password/email endpoints, where lack of rate limiting and distinct error messages allow attackers to confirm identity factors and reset passwords for any member account. This enables full account takeover, exposing profile data, full IBAN, and fiscal documents.

CVE-2026-84314 is an improper authorization vulnerability in 0xJacky's nginx-ui that allows any authenticated user to change any other user's password without requiring two-factor authentication (2FA). The vulnerable endpoint POST /api/users/:id lacks the RequireSecureSession middleware, unlike other sensitive operations that enforce 2FA. This flaw enables an attacker to take over the initial admin account by changing its password, effectively locking out the legitimate admin user.

CVE-2026-108930 is an information disclosure vulnerability in Netcore NR268 version 1.7.121109. It affects the ddns_wan_list_show function in the DDNS Handler component. The vulnerability arises from manipulation of the user_idN/passwordN arguments, which can be exploited remotely. The vendor has not responded to the disclosure, and no patch or remediation is currently documented. The CVSS 4.0 base score is 5.1, indicating medium severity.

CVE-2026-84320 is a path traversal vulnerability in 0xJacky's nginx-ui affecting versions prior to 2.4.3. The issue arises because the auto-backup filename is constructed from a user-controlled name without sanitizing path separators or '..' components, allowing an authenticated user to escape the intended backup storage directory. This bypasses the administrator-defined backup path boundary, potentially enabling backup archives and sensitive encrypted key files to be written outside authorized directories with the privileges of the nginx-ui process.

Telegram-Stremio through version 5.1.0 suffers from an authorization bypass vulnerability that allows authenticated users to access arbitrary chat messages by forging stream IDs. This flaw enables attackers to enumerate message IDs and exploit a global flag to route requests through the operator's Userbot account, exposing private chats and saved messages. Additionally, an unauthenticated endpoint leaks chat thumbnails without token validation.

Telegram-Stremio versions up to 5.1.0 store the operator's authenticated Telegram session string insecurely in a MongoDB database, backups, or logs. The session string is protected only by a reversible encoding without a secret key, allowing attackers with access to these storage locations to recover it. This vulnerability enables attackers to fully authenticate as the operator on Telegram, even bypassing two-step verification.

CVE-2026-108929 is a critical vulnerability in Netcore NR268 version 1.7.121109. It involves an argument injection flaw in the execvp function within the /router/DDNSset.cgi file of the DDNS component. This flaw allows remote attackers to manipulate the Hostname argument, potentially leading to unauthorized command execution.