NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain an out-of-bounds read vulnerability in the USB_DeviceCdcRndisSetCommand() function. This flaw arises because the function trusts a host-supplied informationBufferOffset, allowing a malicious USB host to send crafted RNDIS SET messages with out-of-range offsets. Exploiting this vulnerability can lead to disclosure of device memory.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values without proper validation. A malicious USB device can exploit this by supplying crafted descriptors that overflow the fixed-size epList array, leading to heap memory corruption. This can result in code execution or denial of service on the affected system.
A security flaw in Kameleo up to version 5.3.1 affects the CookieController.ListCookies function, allowing remote attackers to manipulate the 'guid' argument to disclose information. The vulnerability is classified as CWE-200 (information disclosure). The vendor was contacted but did not respond, and no patch or fix information is available. The CVSS 3.1 base score is 4.3, indicating a medium severity issue.
A code injection vulnerability exists in AllenAI AllenNLP up to version 2.10.1 in the Registrable.resolve_class_name function. This flaw allows remote attackers to manipulate the Type argument, potentially leading to code execution. The vulnerability affects unsupported versions, and no vendor response or patch is available. Public exploit code exists, increasing the risk of exploitation.
MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password. The flaw exists because the check_msg() function does not verify the recipient of the recovery message, enabling attackers to request a recovery code to their own mailbox and then use it to reset the password of a victim's account via their email or phone.
Kameleo versions up to 5.0.1.26 contain a server-side request forgery (SSRF) vulnerability in the Proxy Validation component. The flaw exists in the InternalController.TestProxy function, where manipulation of the host/port argument can lead to SSRF. This vulnerability can be exploited remotely. The issue is addressed by upgrading to version 5.2.0, which removes the vulnerable route and replaces it with a safer alternative.
RosarioSIS versions prior to 12.9.2 contain a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, enabling them to act with the administrator's privileges.
Dolibarr ERP CRM versions from 19.0.0 up to but not including 23.0.4 contain an SQL injection vulnerability in the third-party bankaccounts REST API endpoint. Authenticated users with societe/creer permission can exploit this flaw by injecting SQL via the 'type' field, potentially reading sensitive data such as password hashes and API keys through time-based blind SQL subqueries.
MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending multiple concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchase of VIP upgrades and paid content.
Webasyst Framework versions through 4.4.0 have a cross-site request forgery (CSRF) vulnerability in the Photos app. This flaw allows remote attackers to trick logged-in users into submitting forged POST requests that can delete photos or change access rights. The vulnerability exists because the Photos app does not enable the framework's opt-in CSRF protection.
Webasyst Framework versions through 4.4.0 have an arbitrary file read vulnerability in the waArchiveTar::writeItem() function. This flaw allows authenticated users with theme management rights to upload theme archives containing symbolic links that point to sensitive files such as wa-config/db.php or /etc/passwd. These files can then be read through the public theme path, potentially exposing sensitive configuration or system information.
MacCMS versions up to 2026.1000.4056 have a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to set arbitrary mac_comment fields, including user_id, enabling them to submit comments that appear to come from any registered user. As a result, attackers can impersonate members by displaying their avatars alongside the forged comments.
A Server Side Request Forgery (SSRF) vulnerability exists in the hackney_url component of the benoitc hackney library. It arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots. This causes the library to bypass allowlist checks and connect to unintended IP addresses. The issue affects hackney versions from 4.0.1 up to but not including 4.9.0.
A vulnerability in JIZHICMS up to version 2.5.6 affects the Pay function in the Front-end Order Handler component. The flaw involves improper authorization due to manipulation of the 'orderno' argument, allowing remote attackers to exploit this issue. The vulnerability has a medium severity rating with a CVSS score of 4.3. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.
Webasyst Framework versions through 4.4.0 have a stored cross-site scripting (XSS) vulnerability in the Photos app. Authenticated backend users with album edit permissions can inject JavaScript via the album url parameter. This injection occurs because the url parameter is not properly escaped in the DialogAlbumSettings.html file, allowing script execution in administrator backend sessions.
Dolibarr ERP CRM versions prior to 24.0.0 contain an OS command injection vulnerability in the htdocs/admin/tools/export.php file. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting a specially crafted mysqldump value that chains commands using & characters. Exploitation enables execution of arbitrary operating system commands with the privileges of the web server user.
An improper certificate validation vulnerability in hackney_ssl within the benoitc hackney HTTP client library allows an on-path attacker to impersonate a server pinned to a private certificate authority. The flaw arises because hackney_ssl's partial_chain callback trusts any certificate chain ending in a publicly trusted root, even when a private CA is pinned. Hostname verification still applies, so the attacker must have a publicly trusted certificate for the target hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.
A vulnerability in the hackney HTTP client library (versions 2.0.0 up to but not including 4.9.0) allows credentials such as basic_auth and cookies to be leaked during redirects. When follow_redirect is enabled, redirects from HTTPS to HTTP or to a different port on the same host resend sensitive Authorization and Cookie headers in cleartext or to unintended services. This can expose credentials to on-path attackers.
Certain versions of Harbor contain a server-side request forgery (SSRF) vulnerability in the webhook delivery component. This flaw allows an authenticated attacker with ProjectAdmin permissions to configure webhook policies targeting private or link-local IP addresses. When triggered, Harbor's jobservice sends unauthenticated HTTP POST requests to these internal addresses. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata services.
CVE-2026-112880 is a vulnerability in the hackney_http_connect module of the benoitc hackney HTTP client library. It allows HTTP Request/Response Splitting due to improper neutralization of CRLF sequences in HTTP headers. Specifically, the proxy_auth_fun callback's return value is inserted into the Proxy-Authorization header without validation, enabling injection of additional header lines if it contains CR, LF, or NUL bytes. This affects hackney versions from 2.0.0 up to but not including 4.9.0.