CVE-2026-50636 is a high-severity SQL injection vulnerability in LimeSurvey's RemoteControl API methods invite_participants and remind_participants. These methods pass user-supplied token-ID arrays directly into SQL queries without proper parameterization or input validation, allowing authenticated attackers with tokens/update permission to execute arbitrary SQL commands. The vulnerability enables both data exfiltration and destructive actions such as overwriting administrator passwords or dropping tables. Exploitation requires the RemoteControl interface to be enabled, which is not the default setting.
CVE-2026-50635 is a vulnerability in LimeSurvey's password recovery mechanism where the password-reset link uses the client-supplied HTTP Host header without proper validation. The default configuration does not define the allowedHosts allowlist, effectively disabling host validation. An unauthenticated attacker can submit a forgotten-password request with a spoofed Host header to cause LimeSurvey to send a reset link containing a valid token but with an attacker-controlled hostname. When the victim or an automated scanner accesses this link, the attacker obtains the reset token and can reset the victim's password, leading to account takeover.
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.
CVE-2026-49120 is a server-side request forgery (SSRF) vulnerability in medplum versions before 5.1.14. It affects the subscription worker component, allowing authenticated users to create FHIR Subscription resources with arbitrary endpoint URLs. This enables unauthorized internal network requests, potentially exposing sensitive internal services and data. The vulnerability is fixed in medplum version 5.1.14.
OpenCATS versions up to 0.9.1a have an SQL injection vulnerability in the DataGrid filter handling. Authenticated attackers can exploit this by injecting SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. This bypasses column filter restrictions and allows execution of arbitrary SQL queries on the database.
OpenCATS versions up to 0.9.7.4 have an SQL injection vulnerability in the sortDirection parameter of the DataGrid component. Authenticated users can exploit this flaw via ajax/getDataGridPager.php to perform time-based blind SQL injection attacks, potentially extracting sensitive database information.
XX-Net version 5.16.6 and earlier contain a vulnerability in the WebSocket frame parsing logic within simple_http_server.py. The server incorrectly processes unmasked WebSocket frames by always reading 4 bytes as a masking key regardless of the MASK bit, leading to corrupted application data. This flaw causes improper XOR decoding of the payload and lacks validation of RSV bits, opcode, and FIN fragmentation flags.
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
CVE-2026-47104 is a medium severity vulnerability in libusb before version 1.0.30. It is a one-byte out-of-bounds read in the parse_iad_array() function caused by improper bounds checking when processing malformed USB descriptors. This flaw can be triggered by attackers in virtualized environments with USB passthrough to cause a denial of service.
code100x version 0 contains an authentication bypass vulnerability in its Mobile API. An attacker can impersonate arbitrary users by sending a crafted JSON payload in the 'g' HTTP header. The middleware fails to validate the 'Auth-Key' header value, allowing spoofing of user identity headers that downstream handlers trust, leading to unauthorized access to course data of any enrolled user or administrator.
CVE-2026-40034 is a command injection vulnerability in gitoxide components (gix-submodule, gitoxide, gix) before versions 0.29.0, 0.5.21, and 0.84.0 respectively. It arises from improper validation of the update field in .gitmodules, allowing attackers to inject arbitrary shell commands that execute during submodule updates. This enables remote code execution when Submodule::update() is called on a partially initialized submodule.
FreeRDP versions before 3.26.0 contain a heap-based buffer overflow vulnerability in the gdi_CacheToSurface function. This flaw allows a malicious Remote Desktop Protocol (RDP) server to write out-of-bounds heap memory by exploiting improper rectangle validation. Successful exploitation can lead to remote code execution or cause the client application to crash. The vulnerability is fixed in FreeRDP version 3.26.0.
CVE-2026-47114 is a command injection vulnerability in iina versions before 1.4.3. It allows remote attackers to execute arbitrary commands as the current macOS user by supplying malicious mpv_-prefixed query parameters via the iina://open URL scheme. Exploitation requires user approval of a browser protocol prompt but does not require a valid media file. The vulnerability is fixed in version 1.4.3.
HestiaCP versions 1.2.0 through 1.9.4 have an IP spoofing vulnerability where unauthenticated remote attackers can supply arbitrary IP addresses in the CF-Connecting-IP HTTP header without verification of Cloudflare origin. This flaw allows attackers to bypass authentication controls, evade fail2ban brute-force protections, circumvent per-user IP allowlists, and manipulate authentication audit logs by spoofing trusted IPs.
HestiaCP versions 1.9.0 through 1.9.4 have a deserialization vulnerability in the web terminal component due to a session format mismatch between PHP and Node.js. This flaw allows unauthenticated remote attackers to inject crafted data into HTTP headers, which the Node.js component incorrectly deserializes as trusted session values. Successful exploitation results in root-level code execution on systems with the web terminal feature enabled.
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.