Prometheus versions up to 3.15.1 have a vulnerability where attackers can capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests. This occurs because the system insufficiently protects credentials, allowing attackers controlling the remote-write endpoint or a redirecting server to issue a 3xx redirect and replay the token to their own host.
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.
phpMyAdmin versions up to 5.2.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.
CVE-2026-119562 is an SQL injection vulnerability in phpMyAdmin versions up to 5.2.3. Authenticated users can exploit this flaw by supplying unescaped col_extra and col_attribute values to the /database/central-columns endpoint. This allows injection of SQL commands into INSERT and UPDATE queries executed with controluser privileges, potentially enabling unauthorized reading or modification of other users' configuration-storage data.
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
OpenLiteSpeed versions up to 1.9.4 have an authentication bypass vulnerability in their HTTP/3 implementation. This flaw allows unauthenticated remote attackers to bypass virtual host client certificate requirements by exploiting improper certificate validation in the QuicStream component. Specifically, QuicStream's verifyContext() method always returns true, enabling attackers to present a non-mTLS host's SNI with a protected Host header to access restricted content.
OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows logged-in customers to bypass payment by manipulating reward points during checkout. Attackers can select Free Checkout, apply reward points, then clear them before finalizing the order, causing the system to advance the order without payment.
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
CVE-2026-119555 is an information disclosure vulnerability in Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0. The flaw exists in the core_grades_get_feedback web service, which does not enforce group-membership and enrolment checks. This allows non-editing teachers to iterate user IDs and access grade feedback and personal identity fields such as email addresses of users outside their authorized groups.
CVE-2026-119554 is an SQL injection vulnerability in Moodle's External database enrolment plugin affecting multiple versions including 5.3.0 and earlier releases down to 4.5.15. The flaw allows editing teachers to inject malicious SQL payloads via the course idnumber field, which executes during scheduled synchronization with MySQL/MariaDB external databases. This can lead to unauthorized reading of data and manipulation of enrolment results.
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Jellyfin versions up to 12.4 have an authorization bypass vulnerability in the SuggestionsController.GetSuggestions endpoint. Authenticated non-administrator users can omit the userId parameter in requests to bypass library and parental restrictions. This allows attackers to enumerate restricted media items, including their IDs and server filesystem paths, and stream them without proper authorization.
CVE-2026-119550 is an information disclosure vulnerability in Jellyfin versions up to 12.4. It allows authenticated users, including restricted or parental-controlled accounts, to access hidden item IDs from public or shared playlists. This can lead to unauthorized streaming of media that should be inaccessible.
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
CVE-2026-119547 is an information disclosure vulnerability in Forgejo affecting versions up to 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1. The flaw exists in the GetPublicKey API handler, which does not properly check ownership when looking up keys. Authenticated users with read:user tokens or sessions can enumerate sequential key IDs to access titles, fingerprints, and public key material of other users' SSH, deploy, and principal keys.