Search: 7.3.1.1

Traefik versions from 3.7.0-ea.1 up to but not including 3.7.15 have an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw causes mTLS configured via the auth-tls-secret annotation to be silently disabled when another Ingress on the same host declares a path without matching auth-tls settings. As a result, Traefik falls back to default TLS options, allowing unauthenticated attackers to access backends that require client certificates.

Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 have a path traversal vulnerability in the restore-repo feature. This flaw allows attackers to read files outside the intended dump directory by supplying crafted asset paths containing '../' sequences. Specifically, attackers can manipulate the release.yml file's DownloadURL or PatchURL to import arbitrary files as release attachments during repository restoration.

OPNsense core versions before 26.7.8 have a configuration line injection vulnerability. Authenticated users with wireless-edit privileges can inject arbitrary directives by embedding carriage return and line feed characters in WPA fields such as wpa.identity, wpa.passphrase, or RADIUS shared secrets. This allows attackers to append unauthorized wpa_supplicant or hostapd directives that are loaded by root-run daemons.

OPNsense versions before 26.7.8 have a command injection vulnerability that allows authenticated users with System: Firmware privileges to execute arbitrary commands as root. This is achieved by submitting a malicious firmware mirror URL via the API endpoint /api/core/firmware/set, which is evaluated unsafely. The vulnerability also enables attackers to disable package signature verification through sed injection.

Płatnik software used a weak password encoding algorithm that allowed users who obtained encoded passwords to easily decode them. This vulnerability was fixed in version 10.02.002 (metric 242). The issue has a high severity rating with a CVSS score of 7.7.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving improper neutralization of argument delimiters, classified as an Argument Injection flaw. This vulnerability allows a high privileged attacker with remote access to potentially elevate their privileges within the system. The flaw is identified as CWE-88 and carries a high severity with a CVSS score of 7.2.

A Cross-Site Scripting (XSS) vulnerability exists in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS versions prior to 2026-08-14. This flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript by leveraging a malicious iOS bundle ID. The vulnerability has a high severity rating with a CVSS score of 8.7.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS Command Injection vulnerability due to improper neutralization of special elements. This flaw allows a high-privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. No specific affected versions or patch information are provided in the input data.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a SQL Injection vulnerability (CWE-89) that allows a low privileged remote attacker to potentially expose sensitive information. The vulnerability has a high severity with a CVSS score of 7.1. A fix is available in version 4.8.0 and later.

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted. This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to those requests not following proper flows, this could lead to OS command execution. This issue affects RUT: from 7.22 through 7.24.2; RUTX: from 7.22 through 7.24.2; RUTM: from 7.22 through 7.24.2; RUTC: from 7.22 through 7.24.2; ATRM: from 7.22 through 7.24.2; TAP: from 7.22 through 7.24.2; CAP: from 7.22 through 7.24.2; OXA: from 7.22 through 7.24.2; DAP: from 7.22 through 7.24.2; TRB: from 7.22 through 7.24.2; OTD: from 7.22 through 7.24.2; EBG: from 7.22 through 7.24.2; SWM: from 1.9 through 1.10; TSW: from 1.9 through 1.10.

The JoomSport plugin for WordPress (up to and including version 5.7.14) contains a SQL Injection vulnerability via the 'pgroup' parameter. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries by exploiting insufficient escaping and preparation of the SQL statement. The vulnerability can be triggered by embedding a malicious 'pgroup' value in the [jsMatchPlayerList] shortcode within a post preview, enabling extraction of sensitive database information.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module due to improper neutralization of input during web page generation. This affects versions from 0.0.0 to 3.1.7 and from 4.0.0 to 4.0.1. The vulnerability allows injection of malicious scripts into web pages generated by the module.

The Export and Import Users and Customers plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 2.7.5. This flaw arises from a mismatch in CSV escape characters between the export and import functions, allowing an attacker with Subscriber-level access to create an arbitrary Administrator account by injecting crafted CSV data during the export-import workflow.

An authentication bypass vulnerability exists in Drupal DocCheck Basic version 7.x, allowing attackers to bypass authentication using an alternate path or channel.