roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.
B3log Solo versions up to 4.4.0 have an authorization bypass vulnerability in the ArticleConsole component. Authenticated authors can access and manipulate other authors' articles due to missing ownership checks. This allows listing drafts of other authors, viewing draft content via a user-controlled parameter, and pushing others' articles to the Rhythm community.
PKP Open Journal Systems versions up to 3.5.0-5 contain an insecure direct object reference vulnerability that allows authorized journal or subscription managers to access and manipulate subscriptions of other journals by supplying arbitrary subscription IDs. This enables enumeration of subscriber details and reassignment of subscriptions, potentially revoking legitimate access.
CVE-2026-111608 is an authorization bypass vulnerability in Jeepay versions up to 3.2.9. Authenticated merchant users with the ENT_DIVISION_RECEIVER_DELETE permission can delete other merchants' division receivers by exploiting an ownership check flaw that verifies the wrong database column. This allows attackers to delete profit-sharing receivers belonging to other merchants if certain ID conditions match. The vulnerability has a low CVSS score of 2.3, indicating limited impact and exploitability.
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Jpom versions up to 2.11.12 have an authorization bypass vulnerability in the SshFileController. Authenticated users with SSH file permissions in any workspace can exploit this flaw by supplying foreign SSH asset IDs, allowing them to access SSH hosts of other workspaces. This enables unauthorized reading, modification, and deletion of files across workspaces via multiple endpoints.
eladmin versions up to 2.7 have an authorization bypass vulnerability allowing department-scoped user managers with user:edit or user:del permissions to modify or delete user accounts outside their authorized department scope. This occurs because write handlers do not enforce department checks when processing PUT or DELETE requests to /api/users. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.
A local privilege escalation (LPE) vulnerability exists in the Gigabyte kernel driver gdrv3.sys, used by Gigabyte App Center and EasyTune. The driver exposes a device with no security descriptor, allowing any local user to interact without administrative rights. One vulnerable IOCTL allows arbitrary write-what-where by writing kernel data to user-supplied addresses, enabling token stealing to escalate privileges. Another IOCTL allows arbitrary Model-Specific Register (MSR) read/write, breaking kernel address space layout randomization (KASLR) and enabling syscall hijacking. The vulnerability was reported to Gigabyte in June 2026 and has been fixed by adding security descriptors and whitelisting MSR writes. The fixed driver is no longer exploitable via these methods.
CVE-2026-102552 is a medium severity vulnerability in Amazon FreeRTOS-Plus-TCP versions up to 4.4.1. It involves improper verification of the source of a communication channel in the DNS resolver, which could allow a remote attacker to insert a forged DNS reply into the device's DNS cache. The issue is fixed in version 4.4.2 by enabling ipconfigDNS_CHECK_REPLY_SOURCE_IP.
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.
To remediate this issue, users should upgrade to version V4.4.2.
Candiru spyware was delivered to devices at Al Jazeera Media Network through zero-click attacks using targeted online advertisements. These malicious ads executed code upon rendering without requiring user interaction, a technique termed AdFection by Citizen Lab researchers. The attacks targeted at least 45 devices between 2024 and 2025 and involved infrastructure linked to the Israeli spyware vendor Candiru. The advertising operation placed billions of bids and appeared across tens of thousands of apps and websites, potentially exposing millions of users to malicious domains. Major advertising companies have taken action to remove offending accounts and block malicious domains following disclosure.
CVE-2026-80092 is an authentication bypass vulnerability in Microsoft Identity Web that allows an authorized attacker to elevate privileges over a network. The issue stems from assumed-immutable data leading to improper authentication checks. A fix is available and has been officially released by Microsoft. The vulnerability affects versions from 1.0.0 up to but not including 4.16.1. The CVSS 3.1 base score is 5.3, indicating medium severity.
CVE-2026-109461 is an origin validation error vulnerability in Microsoft Authentication Library (MSAL) for Node.js. It allows an unauthorized attacker to disclose information over a network. The vulnerability affects Microsoft Identity Client for NodeJS versions from 5.0.0 up to but not including 7.1.0. The issue has a medium severity with a CVSS score of 5.9. An official fix is available from Microsoft.
CVE-2026-109588 is a numeric truncation error vulnerability in FreeRTOS-Kernel versions 11.3.0 and 11.3.1 on the Arm Cortex-R82 MPU port. This flaw allows an unprivileged task on MPU-enabled builds to potentially read or write privileged kernel memory beyond the intended buffer boundaries via a stream buffer system call. The vulnerability is fixed in version 11.3.2 and later.
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.
To remediate this issue, users should upgrade to version V11.3.2 or later.
Tandoor Recipes versions prior to 2.6.10 contain a vulnerability where user-supplied ordering parameters in database queries are improperly handled. This allows authenticated users to access related tables via Django ORM order_by calls, potentially exposing sensitive information such as password hashes, email addresses, and administrator status. The issue is fixed in version 2.6.10.