Threat database

RosarioSIS versions prior to 12.9 have an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students from other schools. This occurs via manipulation of the student[] POST array in MassAssignFees.php and MassAssignPayments.php, enabling attackers to alter billing balances outside their authorized school scope.

Bagisto versions before 2.4.5 have a stored cross-site scripting (XSS) vulnerability in the RMA send-message endpoint. Authenticated customers can upload HTML files without validation of type or extension. These files, containing malicious JavaScript, are served under /storage/rma-conversation/. When an administrator opens such a file, the script executes in the context of the shop's origin.

Tanium has fixed an improper certificate validation vulnerability affecting multiple products. The issue involved trusting intermediate CA certificates linked to compromised private keys. The products have been updated to distrust these certificates, mitigating the risk.

emailflare versions before commit cf31f33 have a missing authorization vulnerability in the inbox service's /api/keys routes. This flaw allows any authenticated user to list, create, and revoke API keys. Exploitation enables attackers to mint a global live API key accepted by the /v1/send endpoint to send mail from any domain or revoke existing keys to disrupt integrations.

SourceHut meta.sr.ht versions from 0.56.11 up to but not including 0.89.0 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to register new accounts even when public registration is disabled by exploiting an unchecked GraphQL mutation. The attack involves obtaining a CSRF token from the login page and submitting credentials to the registration endpoint, bypassing intended access controls.

Kore versions prior to 4.3.0 have an integer underflow vulnerability in the handling of HTTP request bodies. This flaw allows unauthenticated attackers to bypass the http_body_max limit by sending more body bytes than declared. By sending oversized first segments across many concurrent POST, PUT, or DELETE requests, attackers can cause the content_length value to wrap, leading to unbounded buffer growth and exhaustion of worker memory.

RosarioSIS versions prior to 12.9 contain a SQL injection vulnerability in the StudentSummary.php component. This flaw allows authenticated non-student users, such as parents, to inject SQL code via the unquoted period_id parameter. Exploitation can lead to unauthorized extraction of administrator password hashes and student records or modification of data through stacked SQL statements.

A vulnerability in miroslavpejic85 MiroTalk P2P up to version 2.0.87 allows improper restriction of excessive authentication attempts in the checkPassword function of the Room Action Handler component. This flaw can be exploited remotely but is considered highly complex and difficult to exploit. A public exploit exists. The issue is resolved by upgrading to version 2.1.38.

A vulnerability in miroslavpejic85 MiroTalk P2P up to versions 2.0.87 and 2.1.38 allows remote attackers to bypass access controls by manipulating the peer_id argument in the CheckPassword function of the Socket IO Handler component. This issue can lead to unauthorized access and impacts confidentiality, integrity, and availability. Upgrading to version 2.1.39 resolves the vulnerability.

ArcReel versions 0.32.0, 0.33.0, and 0.34.0 contain a server-side request forgery (SSRF) vulnerability in the Provider Test-Connection Endpoint (/api/v1/providers/{id}/test). This vulnerability allows remote attackers to induce the server to make unintended requests. The vulnerability has been publicly disclosed, and exploit code may be available. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently provided.

A vulnerability in Umami up to version 3.4.1 allows remote attackers to bypass authorization via manipulation of the Website argument in the Record API Endpoint. The flaw affects an unknown function in src/app/api/record/route.ts. Public exploit details have been disclosed, but the vendor has not responded or issued a fix. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity.

A missing authorization vulnerability exists in emailflare before commit cf31f33 in the POST /api/inbox/compose endpoint. Authenticated users can exploit this flaw to send emails with arbitrary sender addresses, enabling impersonation of other users or the organization to external recipients.

Tanium fixed a low-severity vulnerability involving improper access controls in its Discover product. The flaw could allow limited unauthorized access but does not impact data integrity or availability. No known exploits are reported, and no affected versions are specified.

An information disclosure vulnerability was identified and addressed in Tanium Discover. The flaw could allow an attacker with low privileges to gain access to some information, but it does not impact integrity or availability. The vulnerability has a medium severity rating with a CVSS score of 4.3.

An out-of-bounds read vulnerability (CWE-125) exists in GitHub Enterprise Server's Git service (babeld) SSH implementation. The flaw occurs when the session identifier is sized by the current digest length rather than its own, allowing an attacker with SSH access to re-key to a longer hash algorithm and cause adjacent process memory to be signed and returned to the client. This could lead to limited memory disclosure. The issue affects all versions prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. No known exploits in the wild have been reported.

Tanium fixed a medium-severity vulnerability in its Discover product related to improper access controls. The flaw could allow an attacker with low privileges to gain limited unauthorized access, impacting confidentiality and integrity but not availability. No known exploits or patches are currently documented.

Tanium has addressed a vulnerability in its Discover product related to improper access controls. This flaw could allow an attacker with limited privileges to access sensitive information. The vulnerability has a medium severity rating with a CVSS score of 6.5. No specific affected versions or patch details are provided in the available data.

An information disclosure vulnerability was addressed by Tanium in its Discover product. The vulnerability could allow an attacker with low privileges to gain limited access to information. The issue has a medium severity rating with a CVSS score of 4.3. No specific affected versions or patch details are provided in the available data.

A medium-severity vulnerability (CVE-2026-116668) in Tanium Discover allows uncontrolled resource consumption, potentially leading to denial of service conditions. The flaw does not impact confidentiality or integrity but affects availability. No affected versions or patch information are provided.

A heap-based buffer overflow vulnerability was identified and addressed in Tanium Deploy. This vulnerability could allow an attacker with high privileges to execute arbitrary code, resulting in complete compromise of confidentiality, integrity, and availability of the affected system.