GLPI versions from 0.85 up to but not including 10.0.26, and from 11.0.0 up to but not including 11.0.8, contain a missing authorization vulnerability. Under certain conditions, the permission logic could allow users to access documents not linked to the targeted item, exposing files to unauthorized users. This issue has been fixed in versions 10.0.26 and 11.0.8.
VitaFit cloud API versions before 2026-10-30 have an improper access control vulnerability in the AWS Cognito-issued role. Authenticated attackers can perform s3:PutObject operations across the entire shared S3 bucket instead of being limited to their own folders. This allows overwriting of other users' objects, destroying original content without triggering deletion protections. The vulnerability is fixed as of version 2026-10-30.
ezBookkeeping versions from 0.10.0 up to but not including 1.6.0 use the Gin web framework without properly configuring trusted proxies. This causes the application to trust spoofed X-Forwarded-For headers, allowing an unauthenticated attacker to bypass IP-based access controls by supplying a spoofed allowlisted IP address. Although a valid MCP or API token is still required for protected actions, the spoofed IP is logged and stored, misattributing activity to trusted hosts. The issue is fixed in version 1.6.0.
CVE-2026-122028 is an information disclosure vulnerability in NST Labs Tech Nstbrowser version 1.21.0. It affects an unknown functionality of the /agent/info file within the Local Agent API component. The vulnerability can be exploited remotely without privileges or user interaction. Public exploit code has been disclosed, but the vendor has not responded or issued a fix.
CVE-2026-54381 is a vulnerability in the VitaFit cloud API by Shenzhen Shine Industrial Co., Ltd. affecting versions before 2026-10-30. It involves a misconfigured cloud storage bucket that allows unauthenticated attackers to list and download stored files without any authentication. The exposed bucket contains approximately 129,947 objects, including 126,881 user-uploaded profile images, potentially exposing sensitive personal data. The vulnerability has a high severity with a CVSS score of 8.7. A fix was released on 2026-10-30.
A vulnerability in tsparticles prior to version 4.3.1 allows an unauthenticated attacker to send a malformed JSON body to the HTTP mode of @tsparticles/mcp-server, causing a SyntaxError that terminates the Node.js process. This results in denial of service by making the MCP service unavailable until manually restarted. The issue is fixed in version 4.3.1.
A command injection vulnerability exists in tsparticles versions 4.0.0 through 4.3.1. The stable publish workflow interpolates contributor-controlled release note text directly into a Bash echo command, allowing execution of arbitrary shell commands when a maintainer runs a stable release. This can lead to modification of release artifacts or scripts and potentially compromise secrets like GITHUB_TOKEN. The issue is fixed in version 4.3.2.
CVE-2026-54380 is a stored cross-site scripting (XSS) vulnerability in the VitaFit cloud API by Shenzhen Shine Industrial Co., Ltd. Versions before 2026-10-30 allow authenticated attackers to upload SVG images containing malicious JavaScript to a shared storage bucket. The application does not properly restrict script execution or force downloads for SVG content, enabling JavaScript execution when victims open the file directly in a browser. This vulnerability has a medium severity score of 5.1 and was fixed in version 2026-10-30.
CVE-2026-76893 is a resource consumption vulnerability in the tsparticles TypeScript library prior to version 4.3.2. The issue occurs in the HTTP mode of @tsparticles/mcp-server where a single stateful StreamableHTTPServerTransport instance is shared among all clients. An unauthenticated client can claim this shared transport state by sending an initialization request without an mcp-session-id, causing subsequent clients to be blocked with a 'Server already initialized' error until the server process restarts. The first client's session remains functional. This flaw is fixed in version 4.3.2.
VitaFit cloud API versions before 2026-10-30 have a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials via the POST /front/user/s3/token/ endpoint. These credentials are improperly scoped, enabling attackers to list the shared storage bucket and read or overwrite files belonging to other users. This results in unauthorized cross-user data access and manipulation. The vulnerability has a critical severity with a CVSS score of 9.3 and was fixed on 2026-10-30.
VitaFit cloud API versions before 2026-10-30 have an insecure direct object reference vulnerability that allows authenticated attackers to access other users' data by manipulating user_id or profile_id parameters. This flaw enables attackers to read sensitive information such as email addresses, profiles, body-composition reports, and measurement histories by exploiting predictable identifiers and account enumeration weaknesses.
CVE-2026-63655 is a high-severity vulnerability in the tsparticles TypeScript library prior to version 4.3.1. The HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST requests and accumulates request body chunks in memory without size limits, allowing remote attackers to exhaust Node.js process memory and cause service termination. This issue does not affect confidentiality or integrity. The vulnerability is fixed in version 4.3.1.
VitaFit Android application versions before 2.8.1.0 have an insecure custom URI scheme vulnerability. This flaw allows a malicious app to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture a 30-day Fitbit authorization token with weight scope, enabling them to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API. The vulnerability is fixed in version 2.8.1.0.
CVE-2026-122020 is a denial of service vulnerability in NST Labs Tech Nstbrowser versions 1.2.0 and 1.2.1. The flaw exists in the stopAllBrowsers function of the Local Agent Management Service component. Remote attackers can exploit this vulnerability to cause a denial of service. Public exploit code is available, but no vendor response or patch has been provided.
CVE-2026-102280 is a vulnerability in Sandboxie-Plus prior to version 1.18.6 where a sandboxed process could send specific messages to the SYSTEM service (SbieSvc) to modify files outside the sandbox. This includes changing file attributes, timestamps, writeability, or 8.3 short names. Exploiting short-name redirection may lead to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path. The issue is fixed in version 1.18.6.
VitaFit Android application versions before 2.8.1.0 have an insecure session management vulnerability where unencrypted session tokens (m_session_id) are stored in application backups and remain valid for ten years. An attacker who obtains these tokens can access and modify the victim's account or delete authentication records, blocking legitimate access.
CVE-2026-122266 is a vulnerability in the Amazon EKS Network Policy Agent (aws-network-policy-agent) where improper isolation of shared eBPF connection tracking state could allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods. This affects aws-network-policy-agent versions prior to 1.3.7 and Amazon VPC CNI Managed Add-on versions prior to 1.22.3.
The VitaFit Android application versions prior to 2.8.1.0 contain hardcoded credentials for third-party services such as WeChat, Tencent QQ, and Fitbit. This vulnerability allows attackers to extract these confidential integration secrets by decompiling the APK, potentially enabling abuse of the associated third-party application registrations. The issue is fixed in version 2.8.1.0.
The VitaFit Android application by Shenzhen Shine Industrial Co., Ltd. before version 2.8.1.0 transmits sensitive information over unencrypted HTTP connections due to missing Android network security configuration. This cleartext transmission vulnerability allows attackers on untrusted networks to intercept or modify the app's HTTP traffic, potentially manipulating support content displayed to users.
The VitaFit Android application by Shenzhen Shine Industrial Co., Ltd. before version 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability. This flaw arises from a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname, enabling network attackers to intercept and modify HTTPS traffic. Exploitation can lead to man-in-the-middle attacks that capture account sessions and health-related API data, and attackers may delete authentication records to block legitimate logins. The vulnerability is rated high severity with a CVSS score of 8.7 and was fixed in version 2.8.1.0.