A high-severity remote code execution vulnerability exists in libwebsockets due to improper validation of MQTT PUBACK packet data. This flaw allows unauthenticated remote attackers to write beyond allocated buffers, potentially executing arbitrary code within the affected process.
A heap-based buffer overflow vulnerability exists in the NoMachine nxwebrunner web service, which listens on TCP port 4443 by default. This flaw allows remote attackers to execute arbitrary code without authentication by exploiting improper validation of user-supplied data length before copying it to a heap buffer. The vulnerability has a critical severity with a CVSS score of 9.8.
NocoDB versions 0.300.0 up to but not including 2026.08.0 have a missing authentication vulnerability in the POST /api/v2/oauth/authorize endpoint. This flaw allows unauthenticated attackers to create OAuth authorization codes by sending requests with specific parameters, resulting in unbounded insertion of ownerless authorization code records. The vulnerability is limited by rate limiting but can lead to unauthorized creation of authorization codes.
ZaneOps versions from 1.14.0 up to but not including 1.15.2 contain an authorization bypass vulnerability. This flaw allows any workspace administrator to access another workspace's pending preview environment data by querying an API endpoint without proper project scoping. Exploitation can lead to disclosure of plaintext environment variables and preview basic-auth credentials, using information publicly available from fork pull request comments.
blueprintUE self-hosted edition versions prior to 4.3.4 have a vulnerability related to insufficient session expiration. This flaw allows attackers to reuse stale account confirmation tokens because the system does not properly consider the token's confirmation timestamp. Attackers with access to old confirmation links can activate unconfirmed accounts and bypass cleanup mechanisms.
RosarioSIS versions prior to 12.9 have an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students from other schools. This occurs via manipulation of the student[] POST array in MassAssignFees.php and MassAssignPayments.php, enabling attackers to alter billing balances outside their authorized school scope.
Bagisto versions before 2.4.5 have a stored cross-site scripting (XSS) vulnerability in the RMA send-message endpoint. Authenticated customers can upload HTML files without validation of type or extension. These files, containing malicious JavaScript, are served under /storage/rma-conversation/. When an administrator opens such a file, the script executes in the context of the shop's origin.
Tanium has fixed an improper certificate validation vulnerability affecting multiple products. The issue involved trusting intermediate CA certificates linked to compromised private keys. The products have been updated to distrust these certificates, mitigating the risk.
emailflare versions before commit cf31f33 have a missing authorization vulnerability in the inbox service's /api/keys routes. This flaw allows any authenticated user to list, create, and revoke API keys. Exploitation enables attackers to mint a global live API key accepted by the /v1/send endpoint to send mail from any domain or revoke existing keys to disrupt integrations.
SourceHut meta.sr.ht versions from 0.56.11 up to but not including 0.89.0 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to register new accounts even when public registration is disabled by exploiting an unchecked GraphQL mutation. The attack involves obtaining a CSRF token from the login page and submitting credentials to the registration endpoint, bypassing intended access controls.
Kore versions prior to 4.3.0 have an integer underflow vulnerability in the handling of HTTP request bodies. This flaw allows unauthenticated attackers to bypass the http_body_max limit by sending more body bytes than declared. By sending oversized first segments across many concurrent POST, PUT, or DELETE requests, attackers can cause the content_length value to wrap, leading to unbounded buffer growth and exhaustion of worker memory.
RosarioSIS versions prior to 12.9 contain a SQL injection vulnerability in the StudentSummary.php component. This flaw allows authenticated non-student users, such as parents, to inject SQL code via the unquoted period_id parameter. Exploitation can lead to unauthorized extraction of administrator password hashes and student records or modification of data through stacked SQL statements.
A vulnerability in miroslavpejic85 MiroTalk P2P up to version 2.0.87 allows improper restriction of excessive authentication attempts in the checkPassword function of the Room Action Handler component. This flaw can be exploited remotely but is considered highly complex and difficult to exploit. A public exploit exists. The issue is resolved by upgrading to version 2.1.38.
A vulnerability in miroslavpejic85 MiroTalk P2P up to versions 2.0.87 and 2.1.38 allows remote attackers to bypass access controls by manipulating the peer_id argument in the CheckPassword function of the Socket IO Handler component. This issue can lead to unauthorized access and impacts confidentiality, integrity, and availability. Upgrading to version 2.1.39 resolves the vulnerability.
ArcReel versions 0.32.0, 0.33.0, and 0.34.0 contain a server-side request forgery (SSRF) vulnerability in the Provider Test-Connection Endpoint (/api/v1/providers/{id}/test). This vulnerability allows remote attackers to induce the server to make unintended requests. The vulnerability has been publicly disclosed, and exploit code may be available. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently provided.
A vulnerability in Umami up to version 3.4.1 allows remote attackers to bypass authorization via manipulation of the Website argument in the Record API Endpoint. The flaw affects an unknown function in src/app/api/record/route.ts. Public exploit details have been disclosed, but the vendor has not responded or issued a fix. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity.
A missing authorization vulnerability exists in emailflare before commit cf31f33 in the POST /api/inbox/compose endpoint. Authenticated users can exploit this flaw to send emails with arbitrary sender addresses, enabling impersonation of other users or the organization to external recipients.
Tanium fixed a low-severity vulnerability involving improper access controls in its Discover product. The flaw could allow limited unauthorized access but does not impact data integrity or availability. No known exploits are reported, and no affected versions are specified.
An information disclosure vulnerability was identified and addressed in Tanium Discover. The flaw could allow an attacker with low privileges to gain access to some information, but it does not impact integrity or availability. The vulnerability has a medium severity rating with a CVSS score of 4.3.
An out-of-bounds read vulnerability (CWE-125) exists in GitHub Enterprise Server's Git service (babeld) SSH implementation. The flaw occurs when the session identifier is sized by the current digest length rather than its own, allowing an attacker with SSH access to re-key to a longer hash algorithm and cause adjacent process memory to be signed and returned to the client. This could lead to limited memory disclosure. The issue affects all versions prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. No known exploits in the wild have been reported.