An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.
SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.
Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.
MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to the captured output. This issue affects MongoDB Database Tools from version 3.1.4 through versions before 100.20.1.
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.
CVE-2026-118505 is a vulnerability in team-alembic's ash_authentication component affecting versions from 5.0.0-rc.4 up to but not including 5.0.0-rc.16. It involves improper restriction of excessive authentication attempts, allowing unauthenticated attackers to perform unlimited password and one-time password guessing attempts. The issue arises because the brute force protection strategy is not consistently applied to all authentication actions, particularly OTP sign-in when registration is enabled. This flaw was fixed starting in version 5.0.0-rc.16.
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.
AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.
This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.
Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages affecting Red Hat Enterprise Linux 8.4. The update addresses several issues including out-of-bounds reads, improper memory management, and local privilege escalation vulnerabilities. The advisory covers fixes for CVE-2026-43051, CVE-2026-68476, CVE-2026-74641, CVE-2026-74669, CVE-2026-80714, and an additional local privilege escalation vulnerability identified as ZDI-CAN-33367. These vulnerabilities impact core kernel components such as HID drivers, IP Virtual Server (IPVS), ALSA sound subsystem, and skb_zerocopy memory management. Red Hat recommends applying the update and rebooting affected systems to mitigate these issues.
A Server-Side Request Forgery (SSRF) vulnerability exists in Django versions 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The issue arises from the django.contrib.gis.gdal.SpatialReference component, which does not restrict GDAL's file and network access when parsing spatial reference strings. This allows attackers to induce server-side requests or read local files via crafted input. Earlier unsupported Django versions may also be affected. The vulnerability has a medium severity score of 5.3 and has been fixed in the specified versions.
A vulnerability in Django versions 6.0 before 6.0.10 and 6.1 before 6.1.3 allows authenticated staff users with view-only permissions on certain user models to view full password hashes. This occurs because the password field is not obfuscated in the admin display for user models other than the default AUTH_USER_MODEL or those inheriting the password field via multi-table inheritance. The issue has been fixed in Django 6.0.10 and 6.1.3.
Multiple vulnerabilities have been identified in BaseChat – Audio Dating App, Android version 9.8.1, compromising user privacy and security. The app fails to properly validate TLS server certificates, allowing any self-signed certificate to bypass security checks. Paid user accounts are linked to a third-party RevenueCat subscriber database using raw phone numbers, which can be queried via a public API key embedded in the app. Additionally, the app logs personally identifiable information, including phone numbers of callers, to Android system logs, exposing private data. These issues enable interception and modification of API communication, unauthorized access to user metadata, and leakage of private phone numbers through logs. The vendor has not responded to coordinate remediation.
CVE-2026-113593 is a vulnerability in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 where the cache middleware and cache_page decorator generate identical cache keys for requests that omit a header listed in the response's Vary header and requests that include that header with an empty value. This can allow remote attackers to access cached private data from other requests.
A Server-Side Request Forgery (SSRF) vulnerability exists in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 in the django.contrib.gis.gdal.OGRGeometry module. This flaw allows remote attackers to cause the server to make requests to attacker-controlled destinations via crafted GeoJSON coordinate reference system (crs) members. The issue affects multiple supported Django versions and was reported by the Submersion Security Research Team.
CVE-2026-111211 is a vulnerability in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 where the BaseGeometryWidget.deserialize() method does not properly escape invalid input before logging. This allows remote attackers to inject or forge log entries via crafted geometry values. The issue affects specific Django versions and has been fixed in the stated releases.
CVE-2026-108147 is a vulnerability in Django's MultiPartParser that causes excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding. This issue affects Django versions 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. The vulnerability can lead to denial of service due to resource exhaustion. Fixed versions are available.
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.