Threat database

A high-severity vulnerability (CVE-2026-114613) affects the miniforge3 package, specifically in the MessagePack serializer implementation for Python msgpack. The vulnerability impacts versions prior to 26.7.2.1-r0 and can cause a denial of service (availability impact) without compromising confidentiality or integrity. A patch is available in version 26.7.2.1-r0.

CVE-2026-122050 is a SQL injection vulnerability in Campcodes Complete Sales and Inventory System with Credit Management 1.0. The flaw exists in the processing of the /ahira/login.php file, specifically via manipulation of the 'branch' argument. This vulnerability can be exploited remotely without authentication. Public exploit code is available. The CVSS 3.1 score is 7.3, indicating high severity.

CVE-2026-122049 is a vulnerability in Campcodes Bitcoin Wallet System 1.0 affecting the random_int function in the ForgotPasswordController.php file. It allows improper restriction of excessive authentication attempts, potentially enabling remote exploitation. The attack complexity is high, and exploit code has been published. The CVSS score is low (3.7), indicating limited impact primarily on confidentiality with no integrity or availability impact.

A critical command injection vulnerability exists in Edimax BR-6208AC firmware version 1.32, specifically in an unknown functionality of the /goform/mp endpoint. This flaw allows remote attackers to execute arbitrary commands without authentication. Exploit code has been published, increasing the risk of exploitation. The vendor has not responded to disclosure attempts, and no patch information is available.

VitaFit cloud API versions before 2026-10-30 have an improper access control vulnerability in the AWS role issued by Cognito. This flaw allows authenticated users to perform s3:PutObject operations on the entire shared S3 bucket rather than being restricted to their own folders. Exploitation enables attackers to overwrite other users' objects, destroying original content without triggering deletion protections.

A SQL injection vulnerability exists in the krupalshah EmployeeRecruitmentSystem in the mysql_query function within source/reqformprocessing.php. This vulnerability allows remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The product lacks versioning and is no longer supported by the maintainer. Public exploit code is available. No patch or fix is available due to the product's unsupported status.

VitaFit cloud API versions before 2026-10-30 had a misconfigured cloud storage bucket vulnerability that allowed unauthenticated attackers to list and download stored files. The exposed bucket contained approximately 129,947 objects, including 126,881 user-uploaded profile images, enabling access to sensitive personal data without requiring credentials.

A security vulnerability in Campcodes Complete Advance Loan Management System 1.0 allows remote attackers to perform unrestricted file uploads via the move_uploaded_file function in /loan/application/banner.php. This vulnerability has a CVSS score of 7.3, indicating high severity, and the exploit has been publicly disclosed.

VitaFit cloud API versions before 2026-10-30 have an authentication bypass vulnerability. Remote attackers can submit a linked Google or Facebook account identifier to the login endpoint without proof of ownership, gaining full session access to the victim's account. This allows attackers to read and modify the victim's profile and delete authentication records, blocking legitimate user access.

VitaFit cloud API versions before 2026-10-30 have an excessive data exposure vulnerability in the GET /front/relation/search/ endpoint. Authenticated users can exploit this flaw to retrieve personally identifiable information (PII) and health-related profile data of other users. The exposed data includes identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs. This vulnerability allows attackers to enumerate the user directory by using overlapping alphanumeric search terms.

NST Labs Tech Nstbrowser version 1.21.0 contains a vulnerability in the Local Agent API component, specifically in the /agent/info file. This flaw allows remote attackers to cause information disclosure. The vulnerability has a medium severity with a CVSS score of 4.3. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.

CVE-2026-122048 is a SQL injection vulnerability in the Campcodes Division Regional Athletic Meet Game Result Matrix System up to version 2.1. The flaw exists in the /dipam/check-user.php file where manipulation of the 'abbr' argument allows remote attackers to execute SQL injection attacks. Public exploit code is available for this vulnerability.

Dulwich versions before 1.2.20 have a commit object parsing vulnerability where the _parse_commit function incorrectly resolves duplicate tree headers to the last occurrence instead of the first. This behavior diverges from core Git and can be exploited by attackers to craft commit objects that appear benign to Git but resolve differently in Dulwich, potentially leading to execution of malicious build scripts during dependency installation in Poetry 2.5.1, which uses Dulwich by default.

Alan: Health Insurance for Android version 1.450.0 contains a path traversal vulnerability in its exported ShareReceiverActivity. This flaw allows a malicious co-resident app to write files outside the intended directory by exploiting an unsanitized _display_name parameter from a shared content URI. An attacker can craft an ACTION_SEND intent with directory traversal sequences to overwrite sensitive files within the app's sandbox, such as databases and WebView data, potentially enabling state tampering or code execution without authentication or user interaction.

A denial of service vulnerability exists in NST Labs Tech Nstbrowser up to version 1.2.1. The flaw is in the stopAllBrowsers function of the Local Agent Management Service component. Remote attackers can exploit this issue to cause a denial of service. Public exploit code is available, but the vendor has not responded or issued a fix.

VitaFit cloud API versions before 2026-10-30 have a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can upload SVG images containing malicious JavaScript to a shared storage bucket. The application does not properly restrict script execution or force downloads for SVG content, allowing the JavaScript to execute when a victim opens the file directly in a browser.

VitaFit cloud API versions before 2026-10-30 have a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials via the POST /front/user/s3/token/ endpoint. These credentials are improperly scoped, enabling attackers to list the shared storage bucket and read or overwrite files belonging to other users. This results in unauthorized cross-user data access and manipulation.

VitaFit cloud API versions before 2026-10-30 have an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access other users' data by manipulating user_id or profile_id parameters in certain API endpoints. This allows unauthorized reading of email addresses, profiles, body-composition reports, and measurement histories. The vulnerability is combined with an account-enumeration weakness, enabling large-scale data access.

The VitaFit Android application (com.vt.vitafit) versions before 2.8.1.0 contain an insecure custom URI scheme vulnerability. This flaw allows a malicious app to register the same callback URI scheme (vitafit://vtio.cn) used by VitaFit to intercept Fitbit login tokens. By capturing the 30-day Fitbit authorization token with weight scope, attackers can access the Fitbit Body API to read, create, and delete the victim's weight and body-fat records.

The VitaFit Android application (com.vt.vitafit) versions before 2.8.1.0 contain a vulnerability in TLS/SSL certificate validation. This flaw arises from a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname, enabling network-based attackers to intercept and modify HTTPS traffic. Exploitation allows man-in-the-middle attacks to capture account sessions and health-related API data, and attackers can delete authentication records to block legitimate logins.