Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contain a blind SQL injection vulnerability. This occurs because the getNext() and getPrev() methods expose sandboxed template functionality that improperly passes arbitrary criteria arrays to Craft::configure() without filtering out SQL-related properties like orderBy and where. Authenticated control panel users can exploit this by supplying crafted elementIds values to execute conditional SQL queries under the Craft database account.
A regression in the enforcement of FIPS algorithms in the Python hashlib module affects only Python version 3.14.10 when using OpenSSL in FIPS mode. Other Python versions are not impacted.
Parse Server versions before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 contain a vulnerability in the email address validation logic. The validation uses a regular expression with quadratic runtime complexity and no length limit, allowing an attacker to craft a long email address that blocks the Node.js event loop. This results in a denial of service affecting all clients.
Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are affected by an unauthenticated SQL injection vulnerability in the element search endpoint. This flaw arises because the attribute parameter is concatenated into the SQL query without proper sanitization, and the emulated PDO prepares allow stacked statements. Exploitation enables remote attackers to read and write the database, including setting the admin flag or overwriting password hashes to gain administrator access.
SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service.
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.
WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.
Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contain an SQL injection vulnerability in the GraphQL eager-loading feature. This flaw allows unauthenticated attackers to inject SQL expressions via a crafted select argument, potentially exposing sensitive database content such as password hashes and session tokens.
Craft CMS versions from 5.8.17 up to but not including 5.11.2 contain a privilege escalation vulnerability. This flaw arises because the getOwners() function applies caller criteria without properly cleansing the query configuration. As a result, authenticated control panel users can exploit this to invoke attacker-selected static PHP callables, which can promote any account to administrator privileges.
The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application.
The issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1).
Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impact under certain conditions.
An improper neutralization of input used for large language model (LLM) prompting vulnerability exists in Johnson Controls EasyIO Neo IO Manager and Tools Installer version 1.1.0.0. This flaw allows for Search Order Hijacking, which could lead to unauthorized manipulation of LLM prompt inputs. The vulnerability has a high severity rating with a CVSS score of 8.6.