Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.
The 'tdesign-vue-mono' package version 1.0.1 on RubyGems has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged due to its communication with a domain linked to malicious activity. No CVSS score or detailed technical impact is provided.
Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.
Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.
The npm package 'lineparse' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The ansi-sanitize npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software or control established by the attacker.
CVE-2026-123965 is a prompt injection vulnerability affecting the Jet Admin cloud platform. The issue was mitigated around October 29, 2026, by implementing a sandbox component. No specific affected versions are identified, and no public exploit or CVSS score is available.
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.
The OpenTelemetry Python API's TraceContextTextMapPropagator.extract() method is vulnerable to a regular expression denial of service (ReDoS) attack when processing specially crafted traceparent values. Malicious input containing a trace-context prefix followed by a long whitespace sequence and embedded newlines can cause quadratic-time regex backtracking, leading to excessive CPU consumption and request delays. This vulnerability affects versions prior to 1.45.2. The issue does not allow data disclosure, modification, or code execution but can degrade service availability. The vulnerability is mitigated by upgrading to version 1.45.2 or later, which rejects overly long traceparent values and removes problematic regex patterns.
Soup Sieve versions prior to 3.0.2 contain a regular expression vulnerability in the IDENTIFIER/CSS_ESCAPES regex used during selector compilation. This flaw causes exponential backtracking on a sequence of ambiguous digit-escapes (\9) in CSS selectors, leading to denial of service by hanging the process at compile time. The issue affects the public soupsieve.compile() function and BeautifulSoup's .select() method when processing untrusted selector strings. The vulnerability is fixed in version 3.0.2 and later.
Soup Sieve's CSS selector parser has an uncontrolled recursion vulnerability when parsing nested pseudo-class selectors such as :is(), :not(), :where(), and :has(). An attacker supplying a deeply nested selector string (about 330 levels) can cause a RecursionError by exceeding Python's recursion limit. This leads to a denial of service for the individual request or task parsing the selector. The issue affects versions from 0.4 up to but not including 3.0.2, with a fix available in 3.0.2. No confidentiality or integrity impact is present, and the failure occurs before document matching.
CVE-2026-124041 is a SQL injection vulnerability affecting Catalis WebPro version 5.0. The vendor recommends using the most recently available version of WebPro to address this issue. No specific patch or fixed version is provided in the available data.
The npm package '@claudecode/cli' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
This entry concerns vulnerabilities identified in the Social Security Administration's dce-web component, referenced by CVE-2026-104371. The vulnerabilities include issues related to improper access control (CWE-353), missing or ineffective security mechanisms (CWE-1104), and information exposure (CWE-200). The vulnerabilities were first scanned in July 2026 and re-validated in September 2026. No specific affected versions or CVSS score are provided, and there is no indication of active exploitation or available patches.
CVE-2026-128986 is an incorrect authorization vulnerability in Eclipse BaSyx Go Components up to version 1.1.3. The issue arises because ABAC-enabled deployments match access rules against the fully decoded request path, while the router uses the raw encoded path. This mismatch allows an authenticated user with read access to parts of a resource to read the entire resource if the resource identifier contains encoded slashes (%2F). The vulnerability is fixed in version 1.1.4.
C-Kermit versions from 7.0.197 up to but not including 11.1.515 contain an authentication bypass vulnerability in the IKSD SSL build. This flaw allows attackers with a trusted certificate mapped to a refused account to bypass authentication and gain shell access to any other account by exploiting the Telnet authentication state remaining at AUTH_VALID after a refused certificate login. The vulnerability is fixed in version 11.1.515.