ArcadeDB versions from 26.8.1 up to but not including 26.10.2 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with the updateDatabaseSettings permission can disable the LOAD CSV IP block list by altering the database settings. This allows attackers to clear the blocked IP ranges and issue LOAD CSV requests that can access cloud metadata and internal network services.
ArcadeDB versions prior to 26.10.2 have an improper authorization vulnerability that allows users whose access has been revoked to continue accessing the database through existing open connections using Postgres, Bolt, MongoDB, or Redis wire protocols. This occurs because the system retains a stale ServerSecurityUser executor, enabling continued read and write operations even after user deletion, grant removal, or password changes.
MONAI versions from 1.6.0 up to but not including 1.6.1 contain a remote code execution vulnerability in the Auto3DSeg algo_from_json() function. This flaw allows attackers to execute arbitrary Python code by supplying a crafted algo_object.json file within a work directory. Exploitation involves shipping a malicious algorithm_templates module and specifying a _target_ name that is imported and instantiated during calls to AutoRunner or import_bundle_algo_history, leading to code execution under default configurations.
Traefik versions from 3.2.0 up to but not including 3.7.15 contain a data race vulnerability in the experimental FastProxy feature. This flaw allows unauthenticated attackers to crash the Traefik process by exploiting HTTP/1 protocol upgrades, such as repeatedly opening and aborting upgraded connections like WebSocket. The attack corrupts an unsynchronized shared bufio.Reader, causing an unrecovered panic that terminates the service.
Traefik versions 3.7.11 through 3.7.14 contain an authorization bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw allows users with permission to create Ingress resources to bypass cross-namespace checks on the auth-tls-secret annotation when a cached client TLS authentication option is reused. Exploiting this, an attacker can reference a CA secret from another namespace already used by a different Ingress, enforcing it on their own routes and determining its existence without accessing the secret's contents.
ArcadeDB versions from 21.12.1 up to but not including 26.10.2 have an authorization bypass vulnerability. This flaw allows users with only readRecord privileges to replace the shared GraphQL schema via the read-only query endpoint. By sending a crafted GraphQL type definition with a malicious @sql directive to the /api/v1/query/{database} endpoint, attackers can alter query results returned to other users, including administrators.
A stack-based buffer overflow vulnerability exists in GIMP's PSD plug-in image resource header loader due to incorrect handling of destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a crash and potentially allow arbitrary code execution with the privileges of the user running GIMP. Exploitation requires user interaction to open or trigger parsing of a malicious PSD file. Mitigation includes avoiding untrusted PSD files and removing GIMP if not needed.
The Kirki plugin for WordPress versions prior to 6.2.5 contains a vulnerability that allows unauthenticated attackers to bypass reCAPTCHA verification on frontend forms. By omitting the g-recaptcha-token field in POST requests, attackers can submit forms without valid reCAPTCHA validation. This leads to unlimited form submissions triggering notifications, webhooks, and writes to the submissions table without completing the intended verification.
A vulnerability in the Ickle query parser of Infinispan allows an authenticated user with BULK_READ permission to submit a query with deeply nested predicates that causes recursive parsing to exhaust the Java thread stack, resulting in an uncaught StackOverflowError. This can lead to a denial of service by impacting availability.
Parse Server versions from 9.7.0 up to but not including 9.10.5-alpha.7 contain an information disclosure vulnerability. This flaw allows clients with create or update permissions to read protected field values that are set by beforeSave triggers using dot notation keys when the protectedFieldsSaveResponseExempt setting is false. The vulnerability has a low severity score and does not affect integrity or availability.
Parse Server versions from 9.7.0 up to but not including 9.10.5-alpha.10 have an authorization flaw involving _Installation updates. This flaw allows an attacker who knows another installation's object ID to trigger processing of protected fields in a beforeSave trigger for that installation, even when protectedFieldsTriggerExempt is enabled.
Parse Server versions before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 are affected by a prototype pollution vulnerability. This occurs because user-controlled keys are expanded into objects without checking for own properties. Attackers with class write access can send specially crafted keys using dot notation or ACL entry names that match built-in object members. This can corrupt built-in functions, causing all requests to the server to fail until it is restarted.
Traefik versions from 3.7.0-ea.1 up to but not including 3.7.15 contain an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw causes the silent disabling of mutual TLS (mTLS) configured via the auth-tls-secret annotation. If another Ingress on the same host declares a path without matching auth-tls settings, Traefik falls back to default TLS options, allowing unauthenticated attackers to access backends that require client certificates.
CallBackery versions before 0.62.0 for Perl accept session cookies of any age when sent in the X-Session-Cookie header, allowing indefinite authentication if a session cookie leaks through logs, Referer headers, or browser history. The cookieConf() function only rejects old cookies when sent via the xsc query parameter, not the header.
The Kirki plugin for WordPress versions prior to 6.4.1 has a broken object-level access control vulnerability in its page REST API. This flaw allows users with Kirki edit access, typically granted to the Editor role, to modify titles, slugs, and publication statuses of any non-trashed post, including custom post types and WooCommerce products they do not own. The vulnerability arises because the API relies only on a coarse role-based access check without verifying per-object WordPress capabilities. Exploitation can expose private or draft content or remove published content by manipulating the post_status field.
Skuul School Management System versions up to 2.6.5 contain an access control vulnerability in the ResultChecker::checkResult method. Authenticated students can manipulate the studentId parameter to access other students' examination results without authorization.
A race condition vulnerability in the Epiphany browser allows a malicious website to bypass the TLS/SSL certificate warning page. This occurs because the browser registers a script message handler for TLS errors immediately before loading the error page, creating a brief window where an attacker can exploit predictable page IDs to approve certificate exceptions without user interaction. This flaw enables man-in-the-middle or site spoofing attacks until the browser is restarted.
Dell OpenManage Enterprise versions prior to 4.8.0 have an incorrect permission assignment vulnerability that allows a low privileged local attacker to bypass protection mechanisms. This vulnerability does not require user interaction and impacts confidentiality but not integrity or availability.
Bitcoin Core versions prior to 29.5, 30.4, 31.2, and 32.1 are affected by an out-of-memory (OOM) issue. This vulnerability could cause the software to consume excessive memory, potentially leading to crashes or denial of service conditions.
CallBackery versions before 0.62.0 for Perl have a vulnerability in the session cookie signing mechanism. The signing secret is generated using the built-in rand() function seeded with 32 bits, resulting in a limited secret space of at most 2^32 values. An attacker who obtains a single signed session cookie can perform an offline brute-force attack to recover the secret and then forge session cookies for any user, including administrators.