Threat database

Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.

Part-DB-server versions prior to 2.13.2 contain a vulnerability that allows authenticated users to bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This can lead to uncontrolled resource consumption by storing files larger than the configured limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.

Part-DB-server versions prior to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of SVG files. The server relies on the file extension rather than actual content type to sanitize SVG uploads, allowing authenticated attackers to upload malicious SVG files with JavaScript payloads using non-SVG extensions. When users view these attachments inline, the embedded script executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.

Part-DB-server versions prior to 2.12.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-controlled Part names are rendered using Twig's |raw filter without proper neutralization, allowing injection of arbitrary HTML elements into the BOM validation result page. Although JavaScript execution is blocked by the Content Security Policy, attackers can still inject HTML links, forms, images, and CSS UI elements. The vulnerability is fixed in version 2.12.2.

Part-DB-server versions prior to 2.12.1 contain a hard-coded APP_SECRET value in the .env file committed to the public repository. This secret is used by the Symfony framework to sign remember-me cookies. Because the official Docker image does not override or randomize this secret at startup, an attacker who obtains it can forge authenticated sessions without credentials. This vulnerability has been fixed in version 2.12.1.

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

CVE-2026-54630 is a critical vulnerability in Part-DB-server prior to version 2.12.1 that allows authenticated users with default user privileges to upload .phar files to a web-accessible directory. The upload handler fails to block .phar extensions, which are executed as PHP due to the default Apache configuration routing .phar files to PHP-FPM. This leads to remote code execution as the web server user. The issue is patched in version 2.12.1.

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.

CVE-2026-115638 is a medium severity vulnerability in OpenStack Ironic up to version 39.0.1. It involves improper handling of highly compressed data, specifically a denial of service caused by a configdrive that expands into a very large amount of uncompressed data (a gzip bomb). This can lead to resource exhaustion and service disruption.

An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation. This manipulation of the argument url_route causes open redirect. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-19678 is a high-severity server-side request forgery (SSRF) vulnerability in onPhase Forms version 11.0.14. It allows an unauthenticated remote attacker to supply a malicious URL to a publicly accessible form, enabling access to sensitive internal Apache Solr data. The vulnerability affects the unauthenticated form service component. No patch or remediation details are provided in the available data.

CVE-2026-19677 is a critical authentication bypass vulnerability in onPhase Forms version 11.0.14. It allows unauthenticated remote attackers to impersonate arbitrary tenant users, escalate privileges to TenantAdmin and Designer roles, and execute arbitrary operating system commands by manipulating registration parameters with valid tenant and user identifiers.

CVE-2026-115536 is a cross-site scripting (XSS) vulnerability in the gedelumbung HospitalManagement software affecting the simpan function in the admin routing_pages.php controller. The vulnerability allows remote attackers to inject malicious scripts via the content argument. The software uses a rolling release system, so specific affected or fixed versions are not disclosed. The issue was reported early to the project but has not yet been addressed. Public exploit code is available. The CVSS 4.0 score rates this vulnerability as medium severity.

CVE-2026-115486 is a high severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. It involves an out-of-bounds read in the IPv6 Neighbor Discovery handler due to accessing link-layer address options at a fixed offset without verifying their presence. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses, allowing an attacker on the same network segment to poison the ARP table and redirect network traffic.

CVE-2026-115485 is a medium severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. The DHCPv6 option parser improperly calls strlen() on raw network data without verifying a NUL terminator, leading to out-of-bounds reads. This flaw can cause daemon crashes, minor heap overwrites, or corruption of the iSCSI initiator name. An attacker on the same network segment can exploit this by sending a crafted DHCPv6 Advertise message.

CVE-2026-115484 is a high-severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. The DHCPv4 option parser miscalculates the length of options data, leading to an out-of-bounds read beyond the allocated buffer. This flaw allows an attacker on the same network segment to send a crafted DHCP response that can crash the daemon or corrupt its network configuration.

CVE-2026-115535 is a cross-site scripting (XSS) vulnerability in the gedelumbung HospitalManagement software. It affects the function sistem.php::simpan within the Settings Handler component. The vulnerability arises from improper handling of the Title argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so specific affected versions are not identified. The issue was reported early but remains unaddressed. The CVSS 4.0 score rates this as a medium severity vulnerability.