phpMyAdmin versions up to 5.2.3 have a server-side request forgery (SSRF) vulnerability in setup/validate.php. This flaw allows unauthenticated attackers to make outbound connections by sending crafted POST requests with attacker-controlled host and port values. The vulnerability arises because the setup-disabled guard is missing, enabling attackers to trigger MySQL-protocol connections and probe internal ports through error messages.
phpMyAdmin versions through 5.2.3 have a cross-site request forgery (CSRF) vulnerability that allows remote attackers to execute arbitrary SQL commands by bypassing CSRF token checks on non-AJAX POST requests. This enables attackers to trick authenticated users into submitting malicious SQL queries, which run with the victim's database privileges under HTTP or config authentication.
OPNsense core versions 26.1.6 through 26.7.7 have an authentication bypass vulnerability in the captive portal roaming feature. This flaw allows unauthenticated attackers on the same Layer-2 network segment to hijack authorized client sessions by spoofing MAC-to-IP bindings via forged gratuitous ARP replies. Successful exploitation grants portal access with traffic attributed to the victim.
phpMyAdmin versions up to 5.2.3 have an SQL injection vulnerability in the Designer saveSetting() function. This flaw allows authenticated users to inject SQL through unescaped json_encode() output by sending crafted parameters to the /database/designer endpoint. Exploitation can lead to overwriting other users' designer settings or executing controluser subqueries.
Lago versions through 1.55.0 have an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts without password verification. This occurs via the acceptInvite mutation, enabling attackers to accept an invitation with any password and receive a JWT token. Exploitation can lead to unauthorized access to organizations, billing data, API keys, and payment integrations.
Juspay Hyperswitch versions before 1.128.0 have an authentication bypass vulnerability in the Worldpayxml connector. This flaw allows unauthenticated attackers to forge payment status updates by exploiting the verify_webhook_source function, which always returns true due to lack of enforced mTLS. Attackers who know the merchant_id and Worldpay orderCode can send unsigned XML with lastEvent set to SETTLED to the webhook endpoint, potentially marking unpaid payments as paid or triggering refund, dispute, and payout events.
Certain versions of CakePHP contain an email header injection vulnerability due to incomplete sanitization of header values in SmtpTransport and MailTransport. Attackers who can control custom email headers via Message::setHeaders() or Message::addHeaders() may inject bare carriage return (CR) or line feed (LF) characters, enabling injection of additional headers such as Bcc. This could allow redirection or alteration of outgoing emails.
CakePHP versions up to 5.4.3 have a header injection vulnerability in the FormDataPart component. This flaw allows attackers to inject MIME part headers by supplying unsanitized Content-Type and Content-ID values containing CR/LF sequences. The vulnerability affects attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data, enabling arbitrary header or content injection.
Juspay Hyperswitch versions through 1.128.0 and builds before 2026.10.19.0 have a missing authorization vulnerability. This flaw allows unauthenticated attackers, who possess the merchant's publishable key and a payout ID, to confirm payouts via a specific API endpoint. Attackers can overwrite payout details such as amount, currency, connector, and routing, enabling unauthorized merchant payouts.
CakePHP versions through 5.4.3 have an SQL injection vulnerability in the WindowExpression::range() and frame() methods. This flaw allows attackers to inject SQL by supplying unvalidated frame offsets and directions, which are used in the OVER clause of SQL queries. Exploitation could lead to execution of arbitrary SQL commands with the database connection's privileges.
CakePHP versions through 5.4.3 have a vulnerability in the Http Client CookieCollection component due to improper cookie domain validation. This flaw allows malicious servers to exploit unanchored suffix matching to receive and plant cookies improperly. Attackers controlling domains with suffixes matching the victim's domain or sending Set-Cookie headers with unrelated domain values can steal or inject cookies into client cookie jars.
CakePHP versions through 5.4.3 contain an SQL injection vulnerability that allows attackers to inject arbitrary SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. This vulnerability affects all database drivers used by the connection and can lead to full compromise of confidentiality, integrity, and availability of the database.
Bitwarden Server versions before 2026.10.1 using Entity Framework backends have an authorization bypass vulnerability. This flaw allows organization members to add ciphers to collections they are not authorized to edit. The vulnerability arises because a POST request to /api/ciphers/create with a nulled UserId is treated as administrative, enabling injection of vault items into read-only or inaccessible collections.
SQLite versions before 3.54.0 have an authorization bypass vulnerability in the lookupName() function. This flaw causes the authorizer callback to be invoked only for the first joined table's USING column, allowing attackers who can submit SQL queries to read columns that should be restricted by SQLITE_READ authorizer rules when using RIGHT or FULL JOINs on shared USING columns.
OPNsense versions before 26.7.8 have a command injection vulnerability that allows authenticated users with System: Firmware privileges to execute arbitrary commands as root. This is achieved by submitting a malicious firmware mirror URL via the API endpoint /api/core/firmware/set, which is evaluated unsafely. The vulnerability also enables attackers to disable package signature verification through sed injection.
SQLite versions prior to 3.54.0 contain a use-after-free vulnerability in the R-Tree extension. This flaw allows attackers to cause applications to use freed heap memory by manipulating the %_node shadow table. Specifically, supplying a database that declares %_node WITHOUT ROWID or includes a RAISE(IGNORE) trigger causes nodeWrite() to hash nodes as zero, leading to a crash after node splits.
Element Web and Element Desktop versions before 1.12.32 have a vulnerability where guest credentials passed via URL fragment parameters in the loadSession function can be accepted. This allows remote unauthenticated attackers to log out users and clear local storage, potentially destroying unbacked end-to-end encryption keys by forcing an attacker-controlled guest session.
SQLite versions before 3.54.0 that are built with the session extension have a heap buffer overflow vulnerability in the sqlite3changeset_apply() function. This flaw allows attackers to corrupt heap memory by providing specially crafted changesets that exploit improper memory handling when a table name is repeated with a larger column count in a second changeset block.
A remote code execution vulnerability exists in n8n versions before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1. This flaw involves deprecated Function, Function Item, and LangChain Code nodes that run outside the task runner isolation, allowing authenticated users with workflow creation or modification privileges to execute arbitrary JavaScript code in the main n8n process.
SQLite versions prior to 3.54.0 have a stack exhaustion vulnerability that enables attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining a large number of COLLATE postfix operators. This can cause unbounded recursion in the sqlite3WalkExprNN() function, leading to a process crash.