Our payment integration with Oppwa-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment status response from one payment and supply it to the
system for a different payment, gaining access to multiple valid
tickets with only one payment.
Our payment integration with Computop-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment status response from one payment and supply it to the
system for a different payment, gaining access to multiple valid
tickets with only one payment.
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.
Nimiq core-rs-albatross versions prior to 1.4.0 contain a vulnerability where the LightBlockchain::rebranch() function improperly updates blockchain state when adopting a fork chain ending in a macro block. This leads to stale macro block and validator state, causing verification failures and stalling the light client's chain progression. The issue is fixed in version 1.4.0.
CVE-2026-43974 is a high-severity vulnerability in the ninenines gun HTTP client (gun_http module) that allows a malicious HTTP server to force the client into raw protocol mode by sending an unsolicited 101 Switching Protocols response. This causes the client to abandon HTTP framing and accept unbounded data, potentially exhausting memory and crashing the Erlang VM. The issue affects gun versions from 2.0.0 up to but not including 2.4.0.
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.59, POST /api/blocks/{block_id}/execute endpoint executes blocks without consuming any credits, regardless of the user's balance. The credit check that exists in the graph execution path (manager.py) is never reached when blocks are called directly via the external API, allowing unlimited free execution of all blocks. This vulnerability is fixed in 0.6.59.
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request.
This issue affects :
* Devolutions Server 2026.1.6.0 through 2026.1.16.0
* Devolutions Server 2025.3.20.0 and earlier
CVE-2026-42303 is an authentication bypass vulnerability in ethyca's open-source privacy engineering platform, Fides, affecting versions from 2.75.0 up to but not including 2.83.2. When both subject identity verification and duplicate privacy request detection are enabled, an administrator can approve a privacy request without the subject's identity being verified. This flaw can lead to unauthorized erasure of a data subject's records across all integrations configured in the affected deployment. The vulnerability is fixed in version 2.83.2.
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse.
This vulnerability is associated with program files src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs and program routines API sync loop, api-server config handling.
This issue affects RustDesk Client: through 1.4.8.
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.
Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30.
CVE-2026-24774 is a medium severity business logic vulnerability in the Open eClass platform versions prior to 4.2. Authenticated students can exploit this flaw to mark themselves as present in attendance activities, including those that have already expired, by manipulating a crafted URL. This improper enforcement of behavioral workflow (CWE-841) does not impact confidentiality or availability but affects the integrity of attendance records. The vulnerability requires low attack complexity and no user interaction beyond authentication. It has not been observed exploited in the wild and was patched in version 4.2. European educational institutions using Open eClass versions before 4.2 are primarily at risk. Mitigation involves upgrading to version 4.
Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım allows Functionality Misuse.
This issue affects Onaylarım: from 25.09.26.01 through 18112025.
Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.