mailcow: dockerized versions prior to 2026-11 contain a server-side template injection vulnerability. This flaw allows domain administrators to execute arbitrary commands within the shared rspamd container by injecting malicious domain-wide footers. Exploitation involves embedding a Jinja macro with an os.execute default value, which is rendered by the rspamd MOO_FOOTER prefilter. Successful attacks can lead to unauthorized reading or injection of mail across tenants and disabling of mail filtering.
postal-mime versions before 4.2.1 have a parser vulnerability in the address parser that truncates the domain at folding whitespace or comments before a dot. This allows remote attackers to craft From headers that can pass SPF, DKIM, and DMARC alignment checks for their own subdomain while the parser reports a spoofed victim sender address.
Nodemailer versions from 3.0.0 up to but not including 10.4.1 contain an address parsing flaw in the addressparser component. This flaw causes domains to be truncated at folding whitespace or comments before a dot, which can allow attackers to bypass recipient domain restrictions. By crafting to, cc, bcc, or replyTo addresses that appear valid under RFC 5322 domain checks, attackers can cause mail to be delivered to an attacker-controlled address while preserving the application's sender identity. This vulnerability has a high severity score of 8.3 and was fixed in version 10.4.1.
Dolibarr versions 20.0.0 through 23.0.4 and 24.x before 24.0.2 have an insecure direct object reference vulnerability in the expense report payment API endpoints. Authenticated users with read and create rights on expense reports can access and manipulate other users' payment data, including reading, creating, or modifying payments and falsifying reimbursement states. This issue is fixed in version 24.0.2.
ABP Framework versions 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in the DefaultBlobFilePathCalculator component. This flaw allows unauthenticated attackers to access files outside the intended blob container by sending specially encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts. Sensitive files such as appsettings.json, which may contain signing keys and connection strings, can be read by attackers. The vulnerability is fixed in versions 10.6.2 and 10.7.0.
Apache TomEE's Jakarta Security identity store backed by the Tomcat user database has a vulnerability where it compares supplied passwords to stored values as plain text, ignoring the configured credential handler. This allows authentication using stored password digests instead of the actual password. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Meteroid versions before 2.2.0 have an authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler. The vulnerability arises because the UPDATE query filters only on coupon ID and does not verify the tenant ID. This allows authenticated users with catalog:manage permission or a tenant-scoped API key to manipulate coupons belonging to other tenants, including disabling, archiving, or re-enabling them, and to access their details.
Meteroid versions before 2.2.0 have an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler. This flaw allows authenticated users with settings:read permission to access another tenant's API token ID and retrieve its Argon2 secret hash and tenant ID, bypassing tenant context checks.
Firekylin versions up to 2.18.1 have an improper authorization vulnerability that allows users with editor roles to access administrator-only secrets. This occurs because the admin API base guard permits all GET requests, enabling editors to retrieve sensitive data such as TOTP secrets, push credentials, cloud storage keys, and other users' app keys and secrets. This flaw can lead to unauthorized actions like publishing posts as administrators.
CVE-2026-125749 is an authorization bypass vulnerability in vas3k TaxHacker versions up to 0.8.5. It allows authenticated users to manipulate other users' data by providing arbitrary user IDs to server actions. This can lead to unauthorized deletion of categories, clearing of transaction assignments, or modification of LLM prompts. The vulnerability has a low CVSS score of 2.3 and affects cloud-hosted services.
CVE-2026-125748 is an authorization bypass vulnerability in Parabol versions before 15.21.2. It affects the addReactjiToReactable GraphQL mutation, allowing authenticated users to manipulate reactions on content belonging to other organizations by pairing their own meetingId with another tenant's reactableId. This enables unauthorized addition or removal of reactions on reflections, comments, or sequential team prompt responses.
ZenTao PMS versions up to 22.7 have an authorization bypass vulnerability in the build control module. Authenticated users with build privileges can manipulate builds in projects they do not belong to by supplying sequential buildID values. This allows unauthorized deletion, editing, or relinking of stories and bugs in foreign or private projects.
Apache TomEE's development-time LiveReload feature listens on all network interfaces without authentication and accepts websocket connections from any origin. This allows a network attacker or a web page visited by the developer to observe file changes and server version, and potentially access deployed applications through the additional port. The issue affects LiveReload enabled in the embedded Maven plugin. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.
CVE-2026-111250 is an improper authentication vulnerability in Apache TomEE's embedded OpenEJB HTTP server. The server incorrectly reports every request as authenticated when an application requests authentication programmatically, allowing remote unauthenticated attackers to access protected functionality. This affects only applications served by the embedded HTTP server that rely on programmatic authentication. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.
Apache TomEE's standalone OpenEJB server admin service accepts unauthenticated stop requests by default on the loopback interface, allowing any local user or process to stop the server and cause denial of service. This issue affects multiple versions prior to 10.3.0 and 11.0.0-M2, where it has been fixed.
Apache TomEE versions using the embedded OpenEJB HTTP server to publish JAX-WS or JAX-RS endpoints may silently ignore configured authentication methods, resulting in endpoints exposed without authentication. This allows remote unauthenticated attackers to invoke operations without credentials. The issue affects deployments relying on the embedded HTTP server with such authentication methods. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.
Apache TomEE versions from 1.5.1 through 1.7.5, 7.0.0-M1 through before 10.0.0-M1, 10.0.0-M1 through before 10.3.0, and 11.0.0-M1 through before 11.0.0-M2 contain a vulnerability where the default configuration silently adds an administrative user with a well-known password if no users are defined. This allows remote attackers to authenticate using these default credentials and gain administrative access. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE contains an incorrect authorization vulnerability in its optional request routing feature. This flaw allows requests to be forwarded to their configured destinations without enforcing the security constraints or protections of the target web application's private directories. If the routing configuration copies client-controlled parts of the request path, a remote attacker may access protected resources or read sensitive application configuration and class files. The issue affects specific versions of Apache TomEE and is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 use a non-cryptographic pseudo-random number generator (PRNG) to generate HTTP session identifiers by default. This weakness allows a remote attacker who observes a session identifier to predict other session identifiers, potentially hijacking user sessions if HTTP sessions are used for authentication. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE's Jakarta Security OpenID Connect authentication mechanism used a non-cryptographic pseudo-random number generator to create state and nonce values, resulting in insufficient entropy. This weakness allows a remote attacker to predict these values and forge authentication callbacks, potentially logging victims into attacker-controlled accounts and weakening ID token replay protection. The issue is fixed in versions 10.3.0 and 11.0.0-M2.