Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
JSON-SCADA versions before 0.65-alpha contain an SQL injection vulnerability in the opcApi() function within src/server_realtime_auth/index.js. This flaw allows authenticated users to inject SQL commands via HistoryReadRequest parameters, specifically through NodeId.Id, StartTime, or EndTime fields. Exploitation can lead to unauthorized reading, modification, or deletion of historian data across all locations regardless of user role.
CVE-2026-115327 is a medium severity vulnerability in CESNET libyang up to version 6.4.13. It involves an uninitialized pointer free in the function lydxml_env_netconf_rpc() when parsing NETCONF RPC action envelopes. An attacker with a NETCONF session can send crafted action elements containing non-whitespace text to cause server crashes or heap corruption in affected software such as netopeer2.
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
mem0 versions from 0.1.117 up to but not including 1.0.8 contain an SQL injection vulnerability in the file mem0/vector_stores/databricks.py. This vulnerability allows attackers to inject SQL commands by manipulating stored memory content such as memory text, metadata, or message names. The injection occurs due to unescaped string interpolation in insert() and update() operations targeting a Databricks SQL warehouse. The vulnerability has a critical severity with a CVSS 4.0 score of 9.2.
EverShop versions from 1.2.2 up to but not including 2.2.1 have a missing authorization vulnerability in the customer address API. This flaw allows unauthenticated attackers who know customer and address UUIDs to add, modify, or delete other customers' saved shipping addresses via POST, PATCH, or DELETE requests to the /api/customers/:customer_id/addresses endpoint.
fzf versions 0.36.0 through 0.74.5 have an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the --listen HTTP server by sending large POST requests, causing the single-threaded server to block for approximately 30 seconds per request. The vulnerability results from quadratic string concatenation, leading to resource exhaustion on the affected server.
Goploy versions 1.18.0 before 1.18.1 have a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints. Authenticated users with repository write access can exploit this to read arbitrary files outside the project directory by committing symbolic links. This may expose sensitive files such as database configuration and SSH private keys. The vulnerability has a high severity with a CVSS score of 7.1.
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.
Parsedmarc versions from 8.11.0 up to but not including 9.9.0, and from 9.11.0 up to but not including 11.0.4, are affected by multiple cases where aiohttp can consume excessive or unbounded memory or CPU resources when processing attacker-controlled requests. This vulnerability allows an attacker to cause resource exhaustion, potentially impacting service availability.
Splunk and SolarWinds released security updates addressing multiple vulnerabilities that could allow attackers to execute code, escalate privileges, cause denial-of-service, and leak sensitive information. Splunk patched critical improper access control and data exposure issues in Splunk Enterprise and SOAR, while SolarWinds fixed a high-severity broken authorization flaw in Observability and medium-severity XSS, SSRF, and information disclosure bugs. These updates resolve dozens of security defects across product code and third-party libraries.
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
Cisco released patches addressing 34 vulnerabilities across multiple products including Expressway Series, IOS XR, Snort 3, and Unified Communications. The vulnerabilities include critical remote code execution, authentication bypass, and cross-site scripting issues. Notably, a critical remote code execution flaw in Expressway Series could allow attackers to execute arbitrary commands as root. Other critical issues affect Unified Communications and Snort 3 products. Cisco is not aware of any active exploitation of these vulnerabilities in the wild.
A PHP Remote File Inclusion vulnerability (CVE-2026-112820) exists in the Elated-Themes Academist Core plugin up to version 1.4.1. This vulnerability arises from improper control of filenames used in include/require statements, allowing potential local file inclusion. The issue affects Academist Core versions through 1.4.1 and has a high severity rating with a CVSS score of 8.1.
PHP2Shell refers to two critical remote code execution vulnerabilities in PHP disclosed in October 2026. Exploitation attempts began days before official patches were released, with mass scanning and exploitation activity observed immediately after patch publication. Although multiple proof-of-concept exploits circulated rapidly, many were ineffective or caused crashes rather than successful exploitation. The vulnerabilities affect a large number of internet-facing PHP servers, many running end-of-life versions. US cybersecurity authorities have urged immediate patching to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the risk. The vulnerabilities have been compared in impact potential to Log4Shell due to widespread presence and forgotten PHP infrastructure. Mitigations include applying patches promptly and restricting web-facing process permissions as a temporary control.
An authorization bypass vulnerability exists in myCred up to version 4.0.0-beta.1 due to incorrectly configured access control security levels that can be exploited via a user-controlled key. This vulnerability allows an attacker with limited privileges to bypass authorization checks, potentially leading to integrity and availability impacts. The CVSS score is 5.4, indicating a medium severity level.