Coolify versions before 4.1.1 have an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams. This is achieved by exploiting unescaped LIKE wildcards in manual GitHub, GitLab, Bitbucket, and Gitea webhooks, enabling attackers to send crafted repository names and retrieve matching application names before signature verification.
A vulnerability in MongoDB Database Tools mongofiles allows an unauthorized user to exploit symlink resolution issues in parent directories when retrieving files. This can lead to creation of files with unauthorized user-controlled data outside the intended directory, leveraging the operator process's filesystem permissions. The issue affects versions from 100.2.0 up to but not including 100.20.1 and requires the operator to retrieve files from the affected directory.
A missing authorization vulnerability exists in weDevs Dokan dokan-lite up to version 5.3.2. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.
A missing authorization vulnerability exists in WPMU DEV Forminator plugin versions up to 1.58.3. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A Missing Authorization vulnerability (CWE-862) exists in the ClickCease Click Fraud Protection plugin up to version 3.3.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact the integrity of the system. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.
A missing authorization vulnerability exists in WebberZone Better Search up to version 4.5.2. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level with network attack vector and no privileges or user interaction required.
A stored cross-site scripting (XSS) vulnerability exists in Cozmoslabs Paid Member Subscriptions plugin versions up to 3.1.3. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The flaw can lead to partial confidentiality, integrity, and availability impacts.
A vulnerability in MongoDB Database Tools mongofiles allows a user who can modify GridFS file metadata to cause file contents to be written to standard output instead of a local file during retrieval. This can lead to unauthorized disclosure of GridFS content if the output is captured in a location accessible to the attacker. Exploitation requires a higher-privileged operator to retrieve the file without specifying a local destination and attacker access to the captured output. The issue affects versions from 3.1.4 up to but not including 100.20.1.
A Cross-Site Scripting (XSS) vulnerability exists in WPMU DEV Forminator through version 1.58.3 due to improper neutralization of script-related HTML tags. This flaw allows an attacker with low privileges to inject code that can be executed in the context of the affected web page. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level. No public exploits or patches are currently documented.
A vulnerability in APM Server allows an attacker to cause a denial of service by sending oversized OpenTelemetry data payloads. This leads to resource exhaustion and termination of the APM Server process, stopping data intake until a restart occurs.
A missing authorization vulnerability in weDevs Dokan dokan-lite up to version 5.3.2 allows attackers to exploit incorrectly configured access control security levels. The vulnerability could lead to unauthorized information disclosure but does not impact integrity or availability.
A vulnerability in Elasticsearch's analysis-phonetic plugin allows an authenticated user with write or search permissions on an affected index to cause a denial of service. This occurs due to allocation of resources without limits or throttling (CWE-770) when processing specially crafted input values, leading to heap memory exhaustion and potential node unresponsiveness or termination.
A post-authentication SQL Injection vulnerability exists in SonicWall GMS version 9.5.2 and earlier. This flaw could allow an authenticated attacker to access or modify information in the GMS database under specific conditions. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation details are provided, and no known exploits are reported in the wild.
CVE-2026-115289 is a vulnerability in APM Server where multiple resources share duplicate identifiers, leading to potential information disclosure. An authenticated APM agent might receive configuration data intended for a different service until the cache expires, causing misapplication of configuration settings such as sampling parameters.
A path traversal vulnerability (CWE-22) in the Kibana Fleet feature allows a low-privileged user with write access to Fleet agent policies to indirectly cause deletion of restricted resources. Exploitation requires an administrator to perform an action on the affected interface, potentially leading to deletion of Kibana spaces and other organizational assets that the low-privileged user cannot delete directly.
A stored cross-site scripting (XSS) vulnerability exists in WPVibes AnyWhere Elementor plugin versions up to 1.3.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of the affected web application.
An improper certificate validation vulnerability (CWE-295) exists in the operating system certificate bundle included in various Elastic products' Docker images and components. The bundle contains root CAs that trust eight eMudhra intermediate CAs whose private keys have been compromised. An attacker with network access between the product and a remote party could use these compromised keys to issue fraudulent certificates, enabling interception or modification of TLS-protected traffic.
Elasticsearch has a vulnerability involving the use of cache containing sensitive information, which can lead to information disclosure and incorrect search results. Specifically, cached query results may be shared between users with different field-level security restrictions, allowing restricted users to infer data they should not access and causing incomplete results for users with full access. This issue arises only when a user with full access has recently run the same query on the same shard.
Volmarg Personal Management System versions up to 2.1.0 have an unrestricted file upload vulnerability. Authenticated users can upload PHP files via the /upload/send/ endpoint by submitting base64-encoded content with a .php filename. This allows execution of arbitrary code on the server with the web server user's privileges.
A NULL Pointer Dereference vulnerability (CWE-476) exists in the AMQP protocol parser of Packetbeat. This flaw allows an unauthenticated attacker to cause a denial of service by sending specially crafted AMQP network traffic that triggers a Go runtime panic, terminating the Packetbeat process. Exploitation requires network access to the monitored segment but no AMQP authentication. Packetbeat does not collect telemetry when not running.