FreeRDP versions from 3.14.1 up to but not including 3.32.0 contain an integer underflow vulnerability in the WinPR BMP writer. This flaw arises from a mismatched stride calculation that passes a very large value (SIZE_MAX - 3) to a function handling sub-byte images. An attacker controlling an RDP clipboard peer can exploit this by sending a specially crafted 1-bpp BMP image, which is processed by the clipboard image synthesis function, potentially causing the client to crash or suffer an out-of-bounds write.
Coder versions 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contain an open redirect vulnerability in the login page. This occurs because the redirect query parameter is not properly sanitized, allowing attackers to craft login URLs that redirect users to malicious websites. The vulnerability has a medium severity rating with a CVSS score of 4.3.
FreeRDP versions from 2.0.0 up to but not including 3.32.0 contain a heap out-of-bounds write vulnerability in the server hash-callback NTLM authentication path. This flaw arises from failure to properly validate the MIC offset, allowing unauthenticated attackers to send a crafted AUTHENTICATE_MESSAGE that writes 16 zero bytes beyond the allocated memory.
CVE-2026-111865 is a medium-severity vulnerability in THU-MIG yoloe affecting the eval function in ultralytics/nn/autobackend.py. It involves improper neutralization of directives in dynamically evaluated code due to manipulation of certain arguments. The attack requires local access. No versioning is used by the product, so affected versions cannot be precisely identified. The vendor has not responded to the issue report, and no patch or fix is currently available. Public exploit code exists but there are no known exploits in the wild.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana13.2 package to address CVE-2026-109955. This update includes new RPM versions for multiple architectures. The advisory does not specify detailed technical information about the vulnerability or its impact but categorizes it with medium severity.
Coder versions before 2.34.7 contain an IP spoofing vulnerability in the ExtractRealIPAddress middleware. This middleware incorrectly trusts the leftmost client-supplied X-Forwarded-For header value instead of the client IP appended by a reverse proxy. This flaw allows attackers to bypass per-IP rate limits on login and authentication endpoints, facilitating brute-force attacks and falsifying IP addresses in audit logs.
CVE-2026-111933 is a user enumeration vulnerability affecting specific versions of Coder software. The issue arises because the userpassword.Compare() function uses a fixed placeholder hash derived from the string "hunter2" when a stored password hash is empty. Attackers can exploit this by submitting login attempts with the password "hunter2" and observing different HTTP response codes (403 vs 401) to determine valid user accounts and reveal authentication providers for SSO-only users. The vulnerability has a medium severity rating with a CVSS score of 3.7.
Coder versions prior to 2.23.0 contain a session expiration bypass vulnerability where authenticated users can maintain access after their OpenID Connect (OIDC) token expires if no refresh token is issued. This is due to the APIKey cookie remaining active and being extendable every 24 hours through regular use, allowing indefinite access despite expired OIDC authorization.
CVE-2026-110882 is a missing authorization vulnerability in Cozy Vision Technologies Pvt. Ltd.'s SMS Alert Order Notifications plugin, affecting versions prior to 4.0.2. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized modification of information. The vulnerability has a medium severity with a CVSS score of 4.3.
Fleet versions before 4.83.0 have a denial of service vulnerability due to improper handling of gzip-compressed request bodies. Unauthenticated attackers can send small, highly compressed requests to unauthenticated endpoints, which expand during decompression and exhaust server memory, causing the Fleet instance to crash.
Fleet versions prior to 4.89.0 have an unbounded recursion vulnerability in the Apple MDM enrollment property list parsing. This flaw allows unauthenticated attackers to send a crafted binary plist payload that triggers exponential resource consumption, causing the server to crash. The vulnerability can be exploited by sending a payload of about 150 bytes to the enrollment endpoints, leading to CPU and memory exhaustion.
Vikunja versions from 2.2.0 up to but not including 2.7.0 have a permissive Cross-Origin Resource Sharing (CORS) policy that trusts all localhost and 127.0.0.1 ports with credentials. This misconfiguration allows an attacker controlling a page on any localhost port to send credentialed requests to the token refresh endpoint and obtain the bearer JWT token, potentially taking over the logged-in user's account.
Vikunja versions from 0.13.0 up to but not including 2.7.0 have an incorrect authorization vulnerability. This flaw allows project members with Write permission to delete admin-level link shares by exploiting a permission check that reads an unloaded share object. Attackers can send DELETE requests to project share endpoints with sequential share IDs to revoke admin links and invalidate share sessions.
Vikunja version 2.6.0 has an improper privilege management vulnerability in the getProjectAccessForUser function. This flaw causes the system to incorrectly calculate a user's effective project permissions by taking the maximum permission across the project hierarchy, overriding explicit lower permissions on sub-projects. As a result, a collaborator with write access on a parent project but only read access on a child project can improperly modify tasks and content in the child project.
Vikunja versions from 0.22.0 up to but not including 2.7.0 have a vulnerability where removed collaborators can continue to receive project data via webhooks they created before their access was revoked. This improper access revocation allows former collaborators to receive task titles and descriptions, including new content created after their removal.
Vikunja versions from 1.0.0-rc0 up to but not including 2.7.0 have an improper authorization vulnerability in the RecalculateTaskPositions function. Authenticated users without access to any projects can write task_positions rows across all tasks instance-wide. This flaw allows attackers to manipulate their Inbox and create saved filters that persist cross-tenant references, potentially amplifying writes and causing denial of service.
Vikunja versions 2.3.0 up to but not including 2.7.0 have a session validation vulnerability where WebSocket access can persist after session revocation. This occurs because the handleAuth function does not verify the JWT sid claim against the sessions table. As a result, attackers with a stolen access token can maintain WebSocket connections and continue receiving notifications even after the session is deleted or TOTP enrollment occurs.
phpMyFAQ versions 4.0.0 through before 4.1.9 contain an authentication bypass vulnerability in the WebAuthn registration endpoints. This flaw allows attackers to attach credentials to any account without proper authentication or challenge validation. Exploitation enables attackers to register a passkey for a victim's username using a forged attestation and subsequently log in without needing passwords or TOTP, leading to account takeover.
phpMyFAQ versions before 4.1.9 and between 4.2.0-alpha and 4.2.0-beta contain an authorization bypass vulnerability in attachment.php. This flaw allows low-privileged users with the dlattachment right, or anonymous users if allowDownloadsForGuests is enabled, to download attachments from restricted FAQs by bypassing per-record permission checks. The vulnerability has a high severity with a CVSS score of 7.1.