CGI versions before 5.00 for Perl contain vulnerabilities that allow open redirects and script injection via URLs constructed from the client-supplied REQUEST_URI in url and start_form functions. These URLs are built without validation and can lead to protocol-relative, absolute, or javascript: URLs, enabling redirection or injection attacks.
CVE-2026-118625 is a privilege escalation vulnerability in the MLflow Tracking Server caused by missing authorization checks in the get_endpoints function. Exploitation requires authentication, allowing an authenticated user to escalate privileges to access normally protected resources. The vulnerability has a medium severity rating with a CVSS score of 6.3.
CVE-2026-118624 is an information disclosure vulnerability in MLflow Tracking Server Jobs caused by missing authorization checks in the _find_validator function. Exploitation requires authentication and allows remote attackers to disclose sensitive information accessible to the service account.
A privilege escalation vulnerability exists in MLflow Tracking Server due to missing authorization checks in the BEFORE_REQUEST_HANDLERS configuration. Exploitation requires authentication and allows attackers to gain elevated privileges to access normally protected resources.
CVE-2026-114552 is an XML External Entity (XXE) vulnerability in MailEnable's parseObjectResponse method. It allows authenticated remote attackers to disclose sensitive information due to improper restriction of XML external entity references. The vulnerability impacts confidentiality but does not affect integrity or availability. No patch information is currently available.
CVE-2026-114551 is an information disclosure vulnerability in MailEnable where mailbox credentials are stored in cleartext. This flaw allows remote attackers to obtain sensitive authentication information without requiring authentication. Exploitation requires high attack complexity but no user interaction. The vulnerability can lead to credential disclosure and potential further compromise if combined with other vulnerabilities. No patch or remediation information is currently available.
CVE-2026-118623 is a remote code execution vulnerability in MLflow related to insecure deserialization of pickle files. An attacker can exploit this by tricking a user into opening a malicious file or visiting a malicious page, leading to arbitrary code execution within the context of the MLflow process.
A high-severity remote code execution vulnerability exists in libwebsockets due to improper validation of MQTT PUBACK packet data. This flaw allows unauthenticated remote attackers to write beyond allocated buffers, potentially executing arbitrary code within the affected process.
A heap-based buffer overflow vulnerability exists in the NoMachine nxwebrunner web service, which listens on TCP port 4443 by default. This flaw allows remote attackers to execute arbitrary code without authentication by exploiting improper validation of user-supplied data length before copying it to a heap buffer. The vulnerability has a critical severity with a CVSS score of 9.8.
NocoDB versions 0.300.0 up to but not including 2026.08.0 have a missing authentication vulnerability in the POST /api/v2/oauth/authorize endpoint. This flaw allows unauthenticated attackers to create OAuth authorization codes by sending requests with specific parameters, resulting in unbounded insertion of ownerless authorization code records. The vulnerability is limited by rate limiting but can lead to unauthorized creation of authorization codes.
ZaneOps versions from 1.14.0 up to but not including 1.15.2 contain an authorization bypass vulnerability. This flaw allows any workspace administrator to access another workspace's pending preview environment data by querying an API endpoint without proper project scoping. Exploitation can lead to disclosure of plaintext environment variables and preview basic-auth credentials, using information publicly available from fork pull request comments.
blueprintUE self-hosted edition versions prior to 4.3.4 have a vulnerability related to insufficient session expiration. This flaw allows attackers to reuse stale account confirmation tokens because the system does not properly consider the token's confirmation timestamp. Attackers with access to old confirmation links can activate unconfirmed accounts and bypass cleanup mechanisms.
RosarioSIS versions prior to 12.9 have an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students from other schools. This occurs via manipulation of the student[] POST array in MassAssignFees.php and MassAssignPayments.php, enabling attackers to alter billing balances outside their authorized school scope.
Bagisto versions before 2.4.5 have a stored cross-site scripting (XSS) vulnerability in the RMA send-message endpoint. Authenticated customers can upload HTML files without validation of type or extension. These files, containing malicious JavaScript, are served under /storage/rma-conversation/. When an administrator opens such a file, the script executes in the context of the shop's origin.
Tanium has fixed an improper certificate validation vulnerability affecting multiple products. The issue involved trusting intermediate CA certificates linked to compromised private keys. The products have been updated to distrust these certificates, mitigating the risk.
emailflare versions before commit cf31f33 have a missing authorization vulnerability in the inbox service's /api/keys routes. This flaw allows any authenticated user to list, create, and revoke API keys. Exploitation enables attackers to mint a global live API key accepted by the /v1/send endpoint to send mail from any domain or revoke existing keys to disrupt integrations.
SourceHut meta.sr.ht versions from 0.56.11 up to but not including 0.89.0 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to register new accounts even when public registration is disabled by exploiting an unchecked GraphQL mutation. The attack involves obtaining a CSRF token from the login page and submitting credentials to the registration endpoint, bypassing intended access controls.
Kore versions prior to 4.3.0 have an integer underflow vulnerability in the handling of HTTP request bodies. This flaw allows unauthenticated attackers to bypass the http_body_max limit by sending more body bytes than declared. By sending oversized first segments across many concurrent POST, PUT, or DELETE requests, attackers can cause the content_length value to wrap, leading to unbounded buffer growth and exhaustion of worker memory.
RosarioSIS versions prior to 12.9 contain a SQL injection vulnerability in the StudentSummary.php component. This flaw allows authenticated non-student users, such as parents, to inject SQL code via the unquoted period_id parameter. Exploitation can lead to unauthorized extraction of administrator password hashes and student records or modification of data through stacked SQL statements.
A vulnerability in miroslavpejic85 MiroTalk P2P up to version 2.0.87 allows improper restriction of excessive authentication attempts in the checkPassword function of the Room Action Handler component. This flaw can be exploited remotely but is considered highly complex and difficult to exploit. A public exploit exists. The issue is resolved by upgrading to version 2.1.38.