The LaserGest mobile application version 1.0.18 uses a hardcoded AES encryption key and initialization vector (IV) to protect stored assistance portal credentials. This practice allows an attacker who can access the application package to extract these cryptographic parameters and decrypt the credentials, exposing them in cleartext. The vulnerability is identified as CWE-321 (Use of Hard-coded Cryptographic Key) and CWE-522 (Insufficiently Protected Credentials).
The am_club mobile application versions from 1.7.194 up to but not including 1.8.198 contain hard-coded MQTT credentials. This vulnerability allows an unauthenticated attacker to connect to the MQTT broker and potentially access or manipulate data across tenant boundaries. The issue is fixed in version 1.8.198.
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.
CVE-2026-118492 is a cross-site scripting (XSS) vulnerability in Eclipse Langium versions 3.0.0 through 4.4.0. The langium-sprotty package fails to HTML-escape diagnostic messages before rendering them in hover popups. This allows attacker-controlled JavaScript to execute in the browser or webview when a malicious source file triggers an unresolved cross-reference error with embedded HTML markup.
A path traversal vulnerability exists in the simulation of actions in the Zypp backend of PackageKit versions before 1.4.1. This flaw allows local attackers to escalate privileges to root. The vulnerability is critical with a CVSS 4.0 score of 9.3, indicating high impact and exploitability under local attack conditions.
The loadIndex function in nmslib hnswlib and Spotify Voyager improperly validates the element count in a serialized HNSW index. This flaw allows an attacker to supply a crafted index file with an element count exceeding the stored capacity, leading to a heap buffer overflow and potential application crash during file loading.
A vulnerability exists in the ssl.get_server_certificate() function when the ca_certs parameter is supplied. In this case, the identity of the certificate is not checked, potentially undermining the trust model of SSL certificate validation.
A path traversal vulnerability exists in kevquirk PureBlog up to version 3.7.2 in the save_page function of includes/lib/content.php within the Page Editor component. This flaw allows remote attackers with high privileges to manipulate the page slug argument to perform path traversal. The issue is fixed in version 3.7.3.
PrestaShop has an authenticated PHP code injection vulnerability in its back-office Performance debug-mode configuration. A user with permission to modify debug settings can inject PHP code via crafted debug cookie parameters, which are written without proper escaping into a PHP configuration file. This injected code executes with web-server privileges when the configuration file is loaded.
CVE-2026-124850 is a SQL injection vulnerability in a database migration script of flowintel versions prior to 4.0.0. The migration process interpolates stored connector identifier values directly into SQL statements without parameterization, allowing an attacker with prior write access to the database to execute arbitrary SQL during an upgrade. This can lead to unauthorized data disclosure, modification, or deletion.
The http.cookiejar.CookieJar component improperly deleted stored cookies when receiving a response with an already expired Set-Cookie header. This deletion occurred without consulting the cookie policy, allowing a server to potentially delete cookies from other domains within a shared cookie jar, such as urllib's HTTPCookieProcessor. The issue was fixed by ensuring the cookie policy is checked before allowing an expired cookie to delete an existing one, in compliance with RFC 6265 section 5.3.
CVE-2026-16283 is an OS command injection vulnerability in Osbil Technology Ltd.'s oPanel software versions before 1.20.66. This flaw allows an attacker with low privileges to execute arbitrary operating system commands without user interaction, potentially leading to full confidentiality, integrity, and availability compromise of the affected system.
A vulnerability in kevquirk PureBlog up to version 3.7.2 allows unrestricted image upload via the admin/upload-image.php endpoint. This flaw can be exploited remotely and affects an unknown function related to image upload in the admin component. The issue is fixed in version 3.7.3.
A SQL injection vulnerability exists in PipraPay version 3.0.0 within the Admin Panel component's deleteData function. This vulnerability allows remote attackers to manipulate the selected_ids/ItemID argument to execute SQL injection attacks. The vulnerability has been publicly disclosed, and exploit code is available. The project has been notified but has not yet issued a response or patch. The CVSS score is 6.3, indicating a medium severity risk.
CVE-2026-119474 is a vulnerability in HAVELSAN Inc.'s Liman Render Engine before version 1.2-81. It involves incorrect permission assignment for a critical resource, which can lead to privilege escalation. The vulnerability has a high severity with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A privilege escalation vulnerability was identified in Firefox for iOS and assigned CVE-2026-121843. This flaw allows an attacker to gain elevated privileges within the Firefox for iOS application. The issue was addressed and fixed in Firefox for iOS version 160.0. The vulnerability has a high severity rating with a CVSS score of 8.8.
A remote code execution vulnerability has been identified in HPE Morpheus Software. This vulnerability allows an attacker with low privileges to execute arbitrary code remotely without user interaction. The flaw is rated with a high severity score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
A vulnerability in HPE Morpheus manager software exposes confidential certificate information. This exposure can lead to a high-impact compromise affecting confidentiality, integrity, and availability of the system.
A vulnerability in PipraPay 3.0.0 affects the hash_hmac function in the pp-token anti-CSRF handler component. This weakness allows remote attackers to manipulate the function, potentially leading to the exposure of hard-coded credentials. The vulnerability has a medium severity score and public exploit code is available. The project has been notified but has not yet issued a response or fix.
CVE-2026-121841 is a moderate impact vulnerability in Firefox for iOS described as 'Other issue'. It was fixed in Firefox for iOS version 160.0. No detailed technical information or CVSS score is provided.