In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
CVE-2026-21157 is a high-severity vulnerability in Samsung Mobile's Bixby prior to version 4.0.85.6. It involves improper input validation that allows privileged local attackers to launch arbitrary activities on the device.
An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.
A weakness in nschloe meshio up to version 5.3.5 affects the VTK Reader component in the file meshio/_vtk_42.py. Manipulating the DIMENSIONS argument can cause uncontrolled memory allocation. The vulnerability can be exploited remotely and has a medium severity rating with a CVSS score of 5.3. The project has been informed but has not yet responded or issued a fix.
A security flaw in dfm feedfinder2 up to version 0.0.4 allows remote attackers to perform server-side request forgery (SSRF) via the find_feeds function in feedfinder2.py. This vulnerability enables an attacker to manipulate server requests, potentially accessing internal resources. The issue was reported to the project early, but no response or fix has been issued yet.
A cross-site scripting (XSS) vulnerability exists in the addlist.php file of the Add Product Page component in configuroweb inventariobasico. The vulnerability arises from improper handling of the product name argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vulnerability has a low CVSS score of 3.5 and public exploit code is available. The project has been notified but has not yet responded or issued a fix.
A security flaw in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8 affects the Request Forwarder component, allowing information disclosure. The vulnerability can only be exploited from the local network. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS score is 4.3, indicating medium severity.
Mattermost versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, and 11.7.x up to 11.7.10 contain a vulnerability in the Agents plugin's mention reminder component. This flaw allows an authenticated user with posting permissions in a channel visible to a system administrator to craft a post with a forged mention reminder. If the administrator clicks this mention, their browser sends an unintended API request that can replace an installed plugin, leading to remote code execution on the server.
A critical vulnerability exists in D-Link DIR-505 version 1.10B02 in the Web Management CGI component. The flaw is in the main function of the /secmark1524.cgi file, where manipulation of certain arguments can create a backdoor. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attacks.
A server-side request forgery (SSRF) vulnerability exists in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8 within an unknown function of the Request Forwarder component. This vulnerability allows remote attackers to manipulate requests, potentially leading to unauthorized internal network interactions. Public exploit code is available. A patch identified by commit b0d3876247a0a64fa0e430e4b21870e41f503182 is recommended to fix the issue.
Volmarg Personal Management System versions up to 2.1.0 contain an OS command injection vulnerability. Authenticated users can exploit this flaw by creating directories with shell metacharacters in the upload/files path and then moving or copying them, resulting in arbitrary shell command execution as the web server user.
Bricks Builder versions 2.4.3 and earlier have a broken access control vulnerability that allows unauthenticated attackers to access restricted post content. By submitting crafted post_status and post_type values to a specific REST endpoint with a publicly obtainable nonce, attackers can view unpublished posts, private content, and WooCommerce coupon data that should be restricted.
gopass versions prior to 1.17.0 have a path traversal vulnerability in the filesystem storage backend. This flaw allows attackers with write access to a shared git-synced password store to craft entries with '../' sequences. When a victim runs a recursive removal command (gopass rm -r), these crafted entries can cause deletion of directories outside the intended password store location.
PiWeb Disable payment method / Partial payment for WooCommerce versions before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler. This flaw allows unauthenticated attackers to modify and read other customers' orders by reusing a nonce from their own order-pay page and supplying sequential order_id values. The vulnerability enables attackers to change payment methods, recalculate fees, and disclose order details such as line items and totals.
Bricks Theme versions 2.4.3 and earlier have an unauthenticated dynamic-data tag injection vulnerability. This flaw allows anonymous attackers to manipulate the urlParams object in the query_result REST endpoint, causing injected values to be re-parsed as dynamic data tags. Exploitation can lead to leakage of sensitive post meta information and the post author's user record, including password hashes, without requiring authentication.
FreeImage (danoli3 fork) versions prior to 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp. This flaw allows attackers to craft malicious GIF files with frame rectangles that exceed the logical screen width, leading to heap memory corruption during GIF playback. The vulnerability arises when the sum of the frame's left position and width surpasses the logical screen width, causing improper memory writes.
python-markdown2 versions through 2.5.5 have a denial of service vulnerability where remote attackers can cause excessive CPU usage by submitting Markdown with unclosed inline link destinations. This triggers repeated rescanning of the document, resulting in quadratic CPU consumption.
FreeImage (danoli3 fork) versions before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder within PluginIFF.cpp. The flaw arises due to missing bounds checks on ByteRun1 runs, allowing crafted IFF/LBM PBM files with runs crossing scanline boundaries to write up to 127 bytes beyond the allocated heap buffer. This vulnerability has a high severity rating with a CVSS score of 7.8.
Dolibarr ERP CRM versions before 24.0.2 have a missing authorization vulnerability in the recruitment module. This flaw allows unauthenticated attackers to access unpublished draft job positions by manipulating the ref parameter. Sensitive information such as job titles, descriptions, salary budgets, and recruiter contact details can be disclosed. The vulnerability has a medium severity rating with a CVSS score of 5.3.