DbGate versions prior to 7.3.3 have a missing authorization vulnerability that allows authenticated users with connection restrictions to bypass LOGIN_PERMISSIONS. This occurs because the test() and save() functions do not call testConnectionPermission, enabling attackers to submit arbitrary connection definitions to probe internal database hosts or overwrite stored connections.
AB Download Manager versions before 1.11.2 have a cross-site request forgery (CSRF) vulnerability in an unauthenticated browser-integration API. This flaw allows remote attackers to write arbitrary files to specified paths by sending crafted requests to the /start-headless-download endpoint. Exploitation can lead to placing malicious payloads in startup folders, enabling code execution upon the next user login.
SQLBot versions through 1.10.3 have a path traversal vulnerability in the importToDb endpoint. Authenticated workspace administrators can exploit this flaw by supplying crafted filePath parameters to read arbitrary files on the server, including files from other workspaces. This allows importing CSV or spreadsheet files from unintended locations into queryable tables.
Padloc versions through 4.3.0 have a missing authentication vulnerability in the ScimServer._handleScimGet() function. This flaw allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers with knowledge of an organization ID can query Users and Groups SCIM endpoints to obtain usernames, emails, names, external IDs, and group memberships.
A critical code injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 Build 202004151405. The flaw is in the loadstring function of the Lua Handler component, allowing remote attackers to execute arbitrary code. Exploit code has been published, but the vendor has not responded or issued a fix.
bbs-go versions through 4.4.6 have an improper certificate validation vulnerability in the sendEmail() function, which sets InsecureSkipVerify to true. This flaw allows network-positioned attackers to intercept SMTP traffic by presenting any certificate, enabling them to capture SMTP PLAIN authentication credentials and potentially read or modify outgoing password-reset and verification emails.
CFNext versions before 3.1.0 have a cryptographic vulnerability where subscription UUIDs are generated as an MD5 hash of the admin password combined with a fixed public salt. This weak derivation allows holders of subscription links to perform offline brute-force attacks to recover the admin password without rate limiting. Successful exploitation enables unauthorized access to the admin panel and exposure of sensitive secrets including Trojan, Clash, Telegram, and Cloudflare API credentials.
HDF5 versions through 2.2.0 have a NULL pointer dereference vulnerability in the H5HL_unprotect() function. This occurs when a corrupted local heap entry is destroyed, leading to a NULL pointer being passed to a cache unpinning function. Opening a crafted malicious HDF5 file can cause the application to crash, resulting in a denial of service.
HDF5 versions through 2.2.0 contain a heap buffer over-read vulnerability in the function H5O__chunk_deserialize() within src/H5Ocache.c. This flaw occurs when decoding object header messages, where the declared message size check does not fully account for certain header fields, allowing a crafted file to cause reads beyond allocated heap memory. Exploitation requires opening a malicious HDF5 file, potentially leading to denial of service or limited disclosure of process memory.
HDF5 versions through 2.2.0 have an uninitialized memory read vulnerability in the H5Z__filter_scaleoffset() function. The flaw arises because the decode path checks reads against the allocated chunk buffer size rather than the actual bytes read from the file, allowing truncated chunks to be decompressed from uninitialized memory. This can lead to disclosure of unrelated heap contents as dataset data when reading a crafted HDF5 file. The issue is a result of an incomplete fix for a previous vulnerability (CVE-2026-19029).
HDF5 versions through 2.2.0 have an out-of-bounds read vulnerability in the H5Z__filter_szip() function when decoding szip-compressed chunks. The vulnerability arises because the function subtracts a 4-byte header from the chunk length without verifying the chunk's minimum size, leading to a length wraparound and out-of-bounds read. This can cause a denial of service if a user or application reads a crafted HDF5 file with a truncated or corrupted chunk. Only builds with szip support are affected.
A denial of service vulnerability exists in rsync versions through 3.5.1 in the delta-transfer sender's hash_search() function. Malicious receivers can exploit this by supplying crafted weak checksums that cause excessive CPU usage on the sender side, leading to resource exhaustion. This affects unauthenticated attackers pulling data from a public daemon module.
HDF5 versions through 2.2.0 have a heap buffer over-read vulnerability in the H5L__extern_traverse() function, which handles external links. This flaw occurs because the function uses strlen() on user data without validating buffer boundaries, potentially reading beyond the allocated heap buffer. A crafted HDF5 file with a malformed external link can trigger this vulnerability when the link is accessed, leading to a denial of service and possible leakage of adjacent heap memory contents.
A vulnerability in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 allows cache key collisions when requests omit or include empty headers listed in the response's Vary header. This can lead to remote attackers accessing private cached data from other requests. The issue affects the UpdateCacheMiddleware and cache_page decorator. Earlier unsupported Django versions may also be affected. The vulnerability has a low severity rating.
A vulnerability in Django versions prior to 6.1.3 and 6.0.10 allows authenticated staff users with view-only permissions to access full password hashes of user models under certain inheritance conditions. This issue affects the display_for_field() function in the Django admin interface, which fails to obfuscate password fields for user models other than AUTH_USER_MODEL or those inheriting the password field via multi-table inheritance. The vulnerability has a low severity rating and does not impact confidentiality beyond password hash exposure, nor does it affect integrity or availability.
A vulnerability in Django's GIS module (django.contrib.gis.gdal.OGRGeometry) prior to versions 6.1.3, 6.0.10, and 5.2.19 allows remote attackers to cause server-side requests to attacker-controlled destinations via crafted GeoJSON input containing external coordinate reference system (CRS) definitions. This issue affects specified Django versions and potentially earlier unsupported series. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 allows remote attackers to inject or forge log entries via crafted geometry values submitted to the BaseGeometryWidget.deserialize() function. This occurs because invalid submitted values are not properly escaped before logging. The issue affects the django.contrib.gis.forms.GeometryField and may also impact earlier unsupported Django versions such as 5.1.x, 5.0.x, and 4.2.x. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 allows attackers to cause server-side requests or local file reads via crafted spatial reference strings. The issue arises because the SpatialReference component and related methods do not restrict GDAL's file and network access when parsing string input. This could lead to information disclosure but does not affect integrity or availability.
A vulnerability in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 causes excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding. This issue affects the MultiPartParser component, which may buffer the entire file in memory before handing it to upload handlers. Earlier unsupported Django versions might also be affected. The flaw does not impact confidentiality or integrity but can cause denial of service due to resource exhaustion.
CVE-2026-119922 is a privilege escalation vulnerability in Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, and 5.1-5.4. It allows remote authenticated users to elevate their privileges due to improper access control. AWS recommends upgrading to newer versions of the extension to address this issue.