Threat database

MongoDB Database Tools mongorestore versions 100.4.0 through before 100.20.1 inconsistently handle the system.buckets. prefix when validating collection names in untrusted dumps. This flaw allows a specially crafted collection name to bypass special-collection guards and namespace filters, potentially enabling the creation of unauthorized user accounts, including those with root privileges, during a restore operation. Exploitation requires operator action with sufficient user-management privileges and cannot be prevented by excluding the admin namespace alone.

SolarWinds Dameware is affected by a DLL hijacking vulnerability that occurs during installation. Exploitation requires local machine access with administrative privileges. The vulnerability can lead to complete compromise of confidentiality, integrity, and availability.

A vulnerability in phpMyAdmin ShapeFile up to version 4.0.1 affects the ShapeRecord::loadFromFile function in the SHP File Handler component. This flaw can cause an infinite loop when processing manipulated ShapeFile data. The vulnerability can be exploited remotely and requires user interaction. Public exploit details have been disclosed, but the vendor has not responded or provided a fix. The issue has a medium severity rating with a CVSS score of 4.3.

Solanum before commit 2ea1382 has a buffer overflow vulnerability in the ms_kill() function. This flaw allows malicious linked servers to send an overlong kill reason that exceeds the 512-byte buffer, causing memory corruption. Exploitation can crash the ircd or potentially lead to remote code execution.

Solanum software versions before commit 2ce64de have a heap-based buffer overflow vulnerability. This flaw allows a malicious linked server to corrupt memory by sending overly long channel names in JOIN or SJOIN messages. Exploitation can cause crashes or potentially remote code execution by triggering strcpy and sprintf overflows in specific functions.

Coolify versions before 4.1.1 have an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams. This is achieved by exploiting unescaped LIKE wildcards in manual GitHub, GitLab, Bitbucket, and Gitea webhooks, enabling attackers to send crafted repository names and retrieve matching application names before signature verification.

A vulnerability in MongoDB Database Tools mongofiles allows an unauthorized user to exploit symlink resolution issues in parent directories when retrieving files. This can lead to creation of files with unauthorized user-controlled data outside the intended directory, leveraging the operator process's filesystem permissions. The issue affects versions from 100.2.0 up to but not including 100.20.1 and requires the operator to retrieve files from the affected directory.

A missing authorization vulnerability exists in weDevs Dokan dokan-lite up to version 5.3.2. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

A missing authorization vulnerability exists in WPMU DEV Forminator plugin versions up to 1.58.3. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A Missing Authorization vulnerability (CWE-862) exists in the ClickCease Click Fraud Protection plugin up to version 3.3.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact the integrity of the system. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.

A missing authorization vulnerability exists in WebberZone Better Search up to version 4.5.2. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level with network attack vector and no privileges or user interaction required.

A stored cross-site scripting (XSS) vulnerability exists in Cozmoslabs Paid Member Subscriptions plugin versions up to 3.1.3. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The flaw can lead to partial confidentiality, integrity, and availability impacts.

A vulnerability in MongoDB Database Tools mongofiles allows a user who can modify GridFS file metadata to cause file contents to be written to standard output instead of a local file during retrieval. This can lead to unauthorized disclosure of GridFS content if the output is captured in a location accessible to the attacker. Exploitation requires a higher-privileged operator to retrieve the file without specifying a local destination and attacker access to the captured output. The issue affects versions from 3.1.4 up to but not including 100.20.1.

A Cross-Site Scripting (XSS) vulnerability exists in WPMU DEV Forminator through version 1.58.3 due to improper neutralization of script-related HTML tags. This flaw allows an attacker with low privileges to inject code that can be executed in the context of the affected web page. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level. No public exploits or patches are currently documented.

A vulnerability in APM Server allows an attacker to cause a denial of service by sending oversized OpenTelemetry data payloads. This leads to resource exhaustion and termination of the APM Server process, stopping data intake until a restart occurs.

A missing authorization vulnerability in weDevs Dokan dokan-lite up to version 5.3.2 allows attackers to exploit incorrectly configured access control security levels. The vulnerability could lead to unauthorized information disclosure but does not impact integrity or availability.

A vulnerability in Elasticsearch's analysis-phonetic plugin allows an authenticated user with write or search permissions on an affected index to cause a denial of service. This occurs due to allocation of resources without limits or throttling (CWE-770) when processing specially crafted input values, leading to heap memory exhaustion and potential node unresponsiveness or termination.

A post-authentication SQL Injection vulnerability exists in SonicWall GMS version 9.5.2 and earlier. This flaw could allow an authenticated attacker to access or modify information in the GMS database under specific conditions. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation details are provided, and no known exploits are reported in the wild.

CVE-2026-115289 is a vulnerability in APM Server where multiple resources share duplicate identifiers, leading to potential information disclosure. An authenticated APM agent might receive configuration data intended for a different service until the cache expires, causing misapplication of configuration settings such as sampling parameters.

A path traversal vulnerability (CWE-22) in the Kibana Fleet feature allows a low-privileged user with write access to Fleet agent policies to indirectly cause deletion of restricted resources. Exploitation requires an administrator to perform an action on the affected interface, potentially leading to deletion of Kibana spaces and other organizational assets that the low-privileged user cannot delete directly.