Threat database

JobOps versions up to and including 0.13.1 contain a server-side request forgery (SSRF) vulnerability in the POST /api/manual-jobs/fetch endpoint. This flaw allows authenticated users, or unauthenticated clients in demo mode, to make the server request internal network resources, including loopback, private IP addresses, or cloud metadata endpoints. Exploitation can lead to disclosure of internal service data and instance metadata.

OpenHealth versions up to 0.2.0 have a critical vulnerability where the API endpoints for health data records lack authentication and authorization checks. This allows unauthenticated attackers who know a record ID to read, modify, or delete medical record data and metadata without restriction.

Aureus ERP versions up to 1.6.0 have a stored cross-site scripting (XSS) vulnerability in the HolidayAction.php component. Authenticated users with permission to create Public Holidays or Mandatory Days can inject malicious JavaScript via unescaped holiday names. This script executes when HR managers or administrators open the Holiday modal, potentially allowing session hijacking.

BMC Helix Network Management on-premises versions 26.3.00 prior to 26.3.01 contain a critical authentication bypass vulnerability. When SAML single sign-on is configured, unauthenticated attackers can log in as the local administrator using any password. This allows attackers to gain SuperAdmin privileges, enabling them to modify device credentials, execute device commands, and alter audit records.

CVE-2026-111282 is an integer overflow or wraparound vulnerability in driftregion iso14229 versions before 0.10.1. It occurs in the Handle_0x38_RequestFileTransfer function, allowing unauthenticated attackers to bypass file path length checks by sending a specially crafted RequestFileTransfer request. This can lead to out-of-bounds reads past the receive buffer, potentially causing crashes or memory disclosure.

Jooan JA-A12 IP cameras with firmware versions 009_20171107 and 05.02.31.105 have a critical remote code execution vulnerability due to hard-coded credentials. Attackers can send specially crafted requests to the /goform/SingleHandlebyCommand endpoint to execute root commands without authentication, gaining full control over the device.

snap7 versions up to and including 1.4.3 have an out-of-bounds write vulnerability in the TSnap7MicroClient::opReadArea() function. This flaw allows malicious or impersonated S7 peers to overflow client buffers by exploiting an unchecked DataLength field. Crafted ReadVar responses can cause memcpy operations of up to 65535 bytes into caller buffers, potentially crashing SCADA, HMI, or gateway processes and corrupting memory.

DragonflyDB versions up to 2.0.2 have a vulnerability where unauthenticated clients can cause unbounded memory allocation by passing a negative COUNT parameter to certain commands (HRANDFIELD, ZRANDMEMBER, SRANDMEMBER). This can lead to memory exhaustion and trigger the operating system's out-of-memory (OOM) killer, terminating the Dragonfly instance and disrupting service for all clients.

CVE-2026-111275 is a medium severity stack-based out-of-bounds read and write vulnerability in the NIFTI-Imaging nifti_clib library up to version 3.0.1. The flaw exists in the nifti_convert_n2hdr2nim() function, where the NIfTI-2 dim[0] value is not range-checked. This allows an attacker to supply a crafted 540-byte NIfTI-2 header via nifti_image_read(), potentially causing application crashes or stack memory corruption.

unarr versions up to and including 1.1.1 contain a heap-based out-of-bounds read vulnerability in the zip_parse_extra_fields() function due to an incorrect ZIP64 extra field length check. This flaw allows an attacker to craft a malicious ZIP archive with sentinel values and a truncated ZIP64 record that can cause the process to read beyond the heap buffer and crash.

unarr versions up to and including 1.1.1 contain an off-by-one heap-based buffer overflow vulnerability in the tar_get_name() function. This flaw can be triggered via the ar_entry_get_name() API by supplying a crafted TAR archive with a full ustar prefix and name, causing a NUL byte to be written past the allocated buffer, leading to heap corruption and potential process crash.

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

CVE-2026-111270 is a medium severity heap-based out-of-bounds write vulnerability in libmodplug up to version 0.8.9.1. It occurs in the CSoundFile::ReadDSM() function due to lack of bounds checking on the nPat variable against MAX_PATTERNS. An attacker can craft a malicious DSM file with excessive pattern chunks or manipulated length values to corrupt heap memory and cause a crash.

CVE-2024-58397 is a heap-based out-of-bounds read vulnerability in the enzo1982 mp4v2 library up to version 2.1.3. It occurs in the MP4File::GetChapters() function when processing crafted QuickTime chapter samples with a declared title length longer than the actual sample size. This can cause applications like mp4chaps to crash or leak adjacent heap memory into chapter titles.

The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.