Threat database

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-46487 is a missing authorization vulnerability in GeoNetwork core-geonetwork versions from 4.0.0-alpha.1 up to but not including 4.2.16 and 4.4.11. The flaw allows unauthenticated remote attackers to bypass access controls in the Elasticsearch-backed search proxy when a client request omits a query field. This results in unauthorized access to the full indexed metadata records that should be restricted. The issue is fixed in versions 4.2.16 and 4.4.11.

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.

The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.

A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.

CVE-2026-82976 is a vulnerability in the image-customization-controller of Red Hat OpenShift Container Platform 4's bare metal provisioning stack. The controller runs an unauthenticated HTTP file server on port 8084 that exposes a browsable directory listing of all registered image UUIDs. These images embed Ignition configs containing sensitive data such as the base64-encoded cluster pull secret, optional SSH keys, proxy settings, and network keyfiles. An attacker on the adjacent provisioning network can enumerate image UUIDs, download images, extract secrets, and gain access to container registries and SSH keys.

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

A vulnerability in codeskyblue gohttpserver through version 1.3.0 involves a hardcoded session secret key. This flaw allows attackers to impersonate any user by forging session cookies, bypassing OpenID Connect authentication and gaining access to all controls.

GNU Gatekeeper (gnugk) versions before 5.16 have an out-of-bounds read vulnerability in the ParseRTCP() function within ProxyChannel.cxx. This flaw allows remote RTP peers to read heap memory beyond the received packets by sending specially crafted RTCP SDES items without a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled. Exploitation can cause the gatekeeper to crash.

Buku versions 5.0 through 5.1.1 have a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL submitted through the unauthenticated /api/bookmarks endpoint. Exploitation can lead to same-origin API requests executed with the viewer's credentials.

A missing authorization vulnerability exists in WC Lovers WCFM Membership plugin (wc-multivendor-membership) up to version 2.12.0. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw could permit unauthorized users with limited privileges to perform actions they should not be allowed to. The vulnerability has a medium severity rating with a CVSS score of 4.3, indicating limited impact primarily on integrity without affecting confidentiality or availability.

Nanosystems Supremo versions for Windows and macOS prior to 5.0.2.3874 have an improper certificate validation vulnerability. This flaw allows attackers on the same network to intercept and relay TLS connections by using self-signed certificates. Exploitation can lead to exposure of sensitive data such as usernames, SHA-256 password hashes, and license codes.

A missing authorization vulnerability exists in WC Lovers WCFM Membership (wc-multivendor-membership) up to version 2.12.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact data integrity. The vulnerability has a medium severity rating with a CVSS score of 5.3 and does not affect confidentiality or availability.

A race condition vulnerability in Bagisto versions before 2.3.16 and 2.4.x before 2.4.1 allows attackers to redeem single-use coupons multiple times by submitting concurrent order requests. This bypasses the intended usage checks for coupons during checkout.