Bazarr versions prior to 1.5.7-beta.14 contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities in the Plex API namespace due to missing authentication and incomplete OAuth state validation. These flaws allow anonymous attackers to manipulate API keys, clear credentials, bind attacker-controlled Plex accounts, and perform configuration changes without authorization. The vulnerabilities enable persistent configuration tampering, denial of service of the Plex integration, and potential server-side request forgery with credential exposure. Version 1.5.7-beta.14 addresses the anonymous API mutation by adding authentication, although some OAuth state validation issues remain.
The neuralwhatsapp npm package contains malicious code that compromises any computer on which it is installed or running. Installation of this package results in a full system compromise, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but full remediation may require rotating all secrets from a separate, uncompromised system due to the risk of persistent malicious software.
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.
A stored cross-site scripting (XSS) vulnerability exists in myTinyWMS versions prior to 1.6.4. The 'name' parameter in product and category management is not properly sanitized, allowing authenticated attackers to inject malicious JavaScript. This script executes in the browsers of other users viewing affected pages, potentially leading to session theft and administrative account compromise. The issue is fixed in version 1.6.4.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.
A missing authorization vulnerability in Frappe LMS prior to version 2.54.0 allows authenticated students to submit quiz results without answer verification via a REST bypass. This can lead to unauthorized course completion and certificate issuance. Additionally, students can create quiz submissions attributed to other users, exhausting their allowed attempts and preventing legitimate submissions. The issue affects quiz result integrity and availability but does not expose other user data or elevate user roles. The vulnerability is fixed in version 2.54.0.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
CVE-2026-55551 is an improper authorization vulnerability in the infonl dimpact-zaakafhandelcomponent (ZAC) prior to version 5.2.0. It allows authenticated low-privileged municipal users to access sensitive case management data across unauthorized case types by exploiting missing authorization checks on certain by-id read endpoints. The flaw permits reading decisions, audit histories, process diagrams, and mailbox configurations without proper policy enforcement. The issue is fixed in version 5.2.0.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
Two vulnerabilities were identified in the AWS Nitro Enclaves SDK for C affecting versions up to v0.4.5. CVE-2026-119116 is a use-after-free flaw in the kmstool-enclave example application that allows a parent EC2 instance application to send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code. CVE-2026-119148 is an input validation issue in the SDK library where a crafted region string can cause the enclave to accept forged AWS KMS server responses, potentially injecting malicious key material. Only enclave images including kmstool-enclave or derived code are affected by the first issue; the second affects the SDK library generally.
The npm package 'ourin-baileys' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The apex-fetch npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
Wekan versions prior to 11.11 contain a vulnerability where user-controlled input is passed to regular expressions without escaping, leading to inefficient regular expression complexity. This allows authenticated users with board membership or site-admin status to craft expressions that cause catastrophic backtracking, consuming excessive database CPU and potentially causing denial of service. The issue is fixed in version 11.11.
CVE-2026-119299 is an out-of-bounds read vulnerability in the gopacket library prior to version 1.7.2. It affects the SCTP chunk chain decoding in layers/sctp.go, where attacker-controlled lengths and counts are passed to sub-decoders without proper bounds checking. This can cause out-of-bounds or inverted slice panics, potentially terminating applications that disable decode recovery or have specific panic handling enabled. The vulnerability impacts availability only and does not lead to data disclosure or modification. The issue is fixed in gopacket version 1.7.2.
CVE-2026-115642 is an incorrect authorization vulnerability in OpenStack keystonemiddleware versions before 13.0.2. An attacker with access to a restricted application credential can bypass restrictions by supplying a custom X-Service-Token header, leading to privilege escalation.
The grizzly-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
CVE-2026-119466 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPExperts APIExperts Square for WooCommerce plugin, affecting versions prior to 4.7.6. This flaw allows an attacker to trick authenticated users into performing unwanted actions without their consent. The vulnerability has been assigned a medium severity with a CVSS score of 5.4. A fix is available in version 4.7.6.
CVE-2026-65566 is a Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine versions prior to 3.8.9. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability affects AI Engine versions from the initial release up to 3.8.8 and has a high severity rating with a CVSS score of 8.8. A fix is available in version 3.8.9.
CVE-2026-119298 is a vulnerability in croc versions prior to 11.5.2 where the receive-side file-readiness loop improperly trusts sender-controlled basenames starting with 'croc-stdin-'. This allows a remote sender, upon user acceptance of the transfer, to overwrite or truncate existing files or replace them with empty files or symlinks without confirmation. The issue is limited to predictable filenames in the 'croc-stdin-' namespace and does not affect dotfiles or symlink targets outside the receive directory. The vulnerability is fixed in version 11.5.2.