Parse Server versions before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 contain a vulnerability in the email address validation logic. The validation uses a regular expression with quadratic runtime complexity and no length limit, allowing an attacker to craft a long email address that blocks the Node.js event loop. This results in a denial of service affecting all clients.
Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are affected by an unauthenticated SQL injection vulnerability in the element search endpoint. This flaw arises because the attribute parameter is concatenated into the SQL query without proper sanitization, and the emulated PDO prepares allow stacked statements. Exploitation enables remote attackers to read and write the database, including setting the admin flag or overwriting password hashes to gain administrator access.
SiYuan versions before 3.8.9 have a nil pointer dereference vulnerability in the privateCacheMiddleware component. Authenticated attackers with a valid API token can exploit this flaw by sending a resources/read request in an initialized MCP session. This triggers a kernel panic that crashes the kernel process and disrupts service availability.
Ground Station versions from 0.6.0 up to but not including 0.8.20 have a vulnerability where the get-orbital-sources Socket.IO handler is accessible to authenticated operator-role users, not just administrators. This handler exposes plaintext usernames, passwords, and tokens for basic and token orbital sources. The write handlers remain restricted to administrators. The vulnerability allows unauthorized read access to sensitive credentials.
Lektor versions through 3.3.14 and 3.4.0b15 have an absolute path traversal vulnerability in the admin API on Windows. This flaw allows attackers to escape the project directory by using drive-letter paths that the cleanup_path function does not properly normalize. Exploitation can occur via malicious web pages using cross-site requests or DNS rebinding against the unauthenticated local server, enabling recursive deletion of directories or writing of attacker-controlled files.
WWBN AVideo versions 29.0 through 29.4.0 have a race condition vulnerability in the PayPalYPT plugin's IPN handling. This flaw allows attackers to bypass IPN replay protection by exploiting a non-atomic deduplication check and insert. As a result, attackers can replay valid recurring-payment notifications concurrently, causing duplicate wallet credits and subscription renewals.
Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contain an SQL injection vulnerability in the GraphQL eager-loading feature. This flaw allows unauthenticated attackers to inject SQL expressions via a crafted select argument, potentially exposing sensitive database content such as password hashes and session tokens.
Craft CMS versions from 5.8.17 up to but not including 5.11.2 contain a privilege escalation vulnerability. This flaw arises because the getOwners() function applies caller criteria without properly cleansing the query configuration. As a result, authenticated control panel users can exploit this to invoke attacker-selected static PHP callables, which can promote any account to administrator privileges.
The ZSIRep client library (ZSIREP.CLIENT.DLL) suffers from improper server certificate validation, allowing man-in-the-middle attackers to impersonate the server and intercept or modify sensitive data. This vulnerability arises because the library registers a process-wide .NET callback that accepts any HTTPS certificate without verification, and this callback persists even after the client is closed, affecting other HTTPS connections in the same application. The issue is fixed in version 2.12.3.1 and in related products KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB, and KS-ASW with their respective fixed versions.
Openwhyd versions prior to 1.65.1 have a NoSQL injection vulnerability that permits unauthenticated attackers to manipulate user lookups by injecting JSON objects into the id parameter. This allows attackers to use MongoDB query operators like $ne or $gt in POST requests to /api/user, enabling them to select and enumerate other users' public profile records.
HCL AION has a vulnerability where HTTPS encryption is not enforced for all requests, allowing some data to be transmitted unencrypted. This could enable attackers on the network to intercept sensitive information, potentially causing confidentiality, integrity, and availability impacts under certain conditions.
HCL AION's GenAI web interface contains an open redirect vulnerability in the user menu component. The logout redirect URL is sourced from a build configuration variable without validation, which could be exploited in phishing attacks to redirect users to malicious sites. The vulnerability has a medium severity rating with a CVSS score of 4.7.
HCL AION suffers from a vulnerability due to a missing or insecure Cross-Origin-Resource-Policy (CORP) header. This flaw allows application resources to be loaded by other origins, which may lead to cross-origin data leakage and unintended security impacts under certain conditions.
HCL AION's GenAI web interface contains an open redirect vulnerability in its session-handling logic. The UserContext component performs a second redirect to the login page using a URL from build configuration without validating the destination. This flaw could be exploited in phishing attacks, potentially causing unintended behavior or security impact under certain conditions. The vulnerability has a medium severity rating with a CVSS score of 4.7.
HCL AION has a vulnerability due to the absence or insecure configuration of the X-Content-Type-Options header. This allows browsers to MIME-sniff responses, which may lead to content being interpreted as an unintended type. Under certain conditions, this could cause unintended behavior or security impact. The vulnerability has a low severity score and no known exploits in the wild.
HCL AION has a vulnerability due to the absence or insecure configuration of the Cross-Origin-Embedder-Policy (COEP) header. This omission weakens cross-origin isolation by allowing embedded cross-origin resources to load without explicit permission. The issue may lead to unintended behavior or security impacts under certain conditions. The vulnerability has a medium severity score of 4.2 (CVSS 3.1). No patch or remediation details are currently provided.
HCL AION has a vulnerability (CVE-2026-35109) where HTTPS-served pages may be cached by browsers or intermediate proxies. This caching can expose sensitive information to unauthorized users who have access to the cache. The vulnerability has a low severity score and does not affect integrity or availability.
An improper neutralization of input used for large language model (LLM) prompting vulnerability exists in Johnson Controls EasyIO Neo IO Manager and Tools Installer version 1.1.0.0. This flaw allows for Search Order Hijacking, which could lead to unauthorized manipulation of LLM prompt inputs. The vulnerability has a high severity rating with a CVSS score of 8.6.
HCL AION's GenAI web interface uses an unencrypted WebSocket connection (ws://) instead of an encrypted one (wss://), which may allow interception of data exchanged over this connection. The vulnerability has a low severity score and does not indicate direct impact on integrity or availability.
HCL AION has a vulnerability where a second WebSocket connection in the GenAI web interface uses an unencrypted protocol (ws://) instead of an encrypted one (wss://). This could allow an attacker on the network to intercept or read data exchanged over this connection. The vulnerability has a low severity score and does not indicate impact on integrity or availability.