PyJWT versions up to 2.13.0 and the current master branch contain a vulnerability where the HMACAlgorithm.from_jwk method accepts an empty HMAC key from a symmetric oct JWK without raising an error. This allows an attacker to forge tokens by exploiting the verification process that uses this empty key, bypassing signature verification when the key is sourced from a JWK with an empty 'k' value. The issue affects verification paths using PyJWK, PyJWKSet, or PyJWKClient. The vulnerability requires no authentication but depends on the verifier trusting a JWKS containing an empty key entry, which can happen due to misconfiguration or unset environment variables. A fix is available.
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.
CVE-2026-114486 is an incorrect authorization vulnerability in Devolutions Server affecting versions prior to 2026.3.11. It allows an authenticated non-administrative user to bypass Network Access Rules on a virtual gateway by exploiting the token generation process, enabling access to hosts that should be denied.
A vulnerability in Devolutions Server versions 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to access MFA secrets of all users via the user list API. This issue stems from insufficient protection of sensitive information in the user list endpoint.
crawlseo versions before 0.2.5 store Google OAuth access and refresh tokens in cleartext within the User.googleTokens database column. This vulnerability allows attackers who have read access to the Postgres database to obtain long-lived refresh tokens in plaintext. With these tokens, attackers can gain indefinite, unauthenticated access to all registered users' Google Search Console data. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information).
crawlseo versions before 0.2.4 have a server-side request forgery (SSRF) vulnerability in the crawler engine. The function isPrivateIp() does not block certain reserved IP ranges and fails to pin the validated address, allowing a time-of-check to time-of-use (TOCTOU) DNS rebinding bypass. An authenticated attacker can add malicious domains resolving to internal or restricted IPs, trigger crawls to access internal services or cloud metadata endpoints, and retrieve limited data such as page titles and status codes via the crawl results API. This enables internal network reconnaissance.
A resource exhaustion vulnerability exists in opentelemetry-python prior to version 1.45.1. The TraceState.from_header function parses W3C tracestate headers using an unbounded optional-whitespace regular expression, which can cause excessive CPU usage when processing a malformed header with a long sequence of spaces or tabs. This can impact availability by consuming excessive CPU resources, potentially delaying or blocking other requests in synchronous or asynchronous environments. The vulnerability does not expose or modify telemetry data and does not allow code execution. The issue is fixed in version 1.45.1.
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is not possible.
Next.js versions from 13.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1, contain a vulnerability where crafted requests targeting App Router applications with Server Actions can cause excessive CPU usage and block further request processing in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
CVE-2026-115453 is an authorization bypass vulnerability in the MarcosCamara01 Ecommerce Template affecting the cart and wishlist repositories. It allows any authenticated user to delete or modify cart and wishlist entries of other users due to improper enforcement of PostgreSQL row level security (RLS). The application connects as the table owner, bypassing RLS policies that rely on user ID checks. Sequential identifiers enable enumeration of other users' cart and wishlist items, leading to unauthorized data modification or deletion.
CVE-2026-115450 is a vulnerability in the MarcosCamara01 Ecommerce Template that allows an authenticated user without special privileges to manipulate the checkout process. The flaw arises because the cart API accepts separate parameters for the product variant and the Stripe price ID without verifying their consistency. This enables an attacker to pay the price of one product while ordering a different, potentially more expensive product. The vulnerability allows repeated exploitation to purchase goods at the price of the cheapest item in the catalogue, causing order records to mismatch the actual payment amount.
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.
CVE-2026-61791 is a stored cross-site scripting (XSS) vulnerability in schorschii OCO-Server prior to version 1.2.1. The vulnerability arises from improper neutralization of script in HTML attributes, specifically in the Html::commandButton() function, which embeds a stored computer hostname into a JavaScript inline onclick handler with insufficient escaping. An attacker with access to the shared agent-registration-key and with self-registration enabled can inject malicious script via a crafted hostname. This script executes in an administrator's authenticated session when activating certain command buttons, potentially allowing abuse of administrative privileges such as deploying software jobs. The issue is fixed in version 1.2.1.
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
Flexible GraphRAG versions from 0.6.0 up to but not including 0.8.2 contain an improper encoding vulnerability in the _escape() helper function. This flaw allows crafted input to inject malicious Cypher clauses that can modify or delete graph data and potentially disclose sensitive information when query results are surfaced. The vulnerability arises from incorrect escaping order and unsafe insertion of dynamic identifiers into Cypher queries. The issue is fixed in version 0.8.2.
Multiple security vulnerabilities have been identified in CUPS, the open source printing system used on UNIX-like operating systems. These include an arbitrary file write due to predictable temporary file handling, command injection via email notification recipient addresses, multiple denial-of-service conditions from null pointer dereferences and double-free errors, and a resource exhaustion vulnerability. These issues affect versions prior to 2.4.0-25.oe2203sp4. A security update addressing these vulnerabilities is available.