ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
SQLite versions prior to 3.54.0 contain a stack exhaustion vulnerability in the countOfViewOptimization() function. This flaw can be triggered by attackers using a crafted SQL query or database file with a deeply nested TK_PLUS expression, causing recursive freeing operations that exhaust the C stack and crash the host process, resulting in denial of service.
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
vsftpd versions up to 3.0.5 have an access control bypass vulnerability where authenticated FTP users can execute commands that should be denied by using RFC 775 X-prefixed aliases. The vulnerability arises because the cmds_denied check only compares literal tokens, allowing commands like XRMD, XMKD, XCWD, XPWD, or XCUP to bypass restrictions and perform blocked operations such as deleting directories.
Prometheus versions up to 3.15.1 have a vulnerability where attackers can capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests. This occurs because the system insufficiently protects credentials, allowing attackers controlling the remote-write endpoint or a redirecting server to issue a 3xx redirect and replay the token to their own host.
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.
phpMyAdmin versions up to 5.2.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.
CVE-2026-119562 is an SQL injection vulnerability in phpMyAdmin versions up to 5.2.3. Authenticated users can exploit this flaw by supplying unescaped col_extra and col_attribute values to the /database/central-columns endpoint. This allows injection of SQL commands into INSERT and UPDATE queries executed with controluser privileges, potentially enabling unauthorized reading or modification of other users' configuration-storage data.
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
OpenLiteSpeed versions up to 1.9.4 have an authentication bypass vulnerability in their HTTP/3 implementation. This flaw allows unauthenticated remote attackers to bypass virtual host client certificate requirements by exploiting improper certificate validation in the QuicStream component. Specifically, QuicStream's verifyContext() method always returns true, enabling attackers to present a non-mTLS host's SNI with a protected Host header to access restricted content.
OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows logged-in customers to bypass payment by manipulating reward points during checkout. Attackers can select Free Checkout, apply reward points, then clear them before finalizing the order, causing the system to advance the order without payment.
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
CVE-2026-119555 is an information disclosure vulnerability in Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0. The flaw exists in the core_grades_get_feedback web service, which does not enforce group-membership and enrolment checks. This allows non-editing teachers to iterate user IDs and access grade feedback and personal identity fields such as email addresses of users outside their authorized groups.
CVE-2026-119554 is an SQL injection vulnerability in Moodle's External database enrolment plugin affecting multiple versions including 5.3.0 and earlier releases down to 4.5.15. The flaw allows editing teachers to inject malicious SQL payloads via the course idnumber field, which executes during scheduled synchronization with MySQL/MariaDB external databases. This can lead to unauthorized reading of data and manipulation of enrolment results.
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.