A high-severity security vulnerability (CVE-2026-116587) affects the loki package, specifically versions prior to 3.5.12-r9. The vulnerability involves the Go JOSE implementation of Javascript Object Signing and Encryption standards, including JSON Web Encryption, Signature, and Token standards. The flaw does not impact confidentiality or integrity but results in a high impact on availability. A patch is available in version 3.5.12-r9.
A security vulnerability exists in the loki package's Go JOSE implementation, which handles Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. Versions prior to 3.5.12-r9 are affected. The vulnerability has a medium severity with a CVSS score of 6.9. A fix is available in version 3.5.12-r9.
A security vulnerability exists in the loki package's Go JOSE implementation, which supports Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. Versions prior to 3.5.12-r9 are affected. The vulnerability has a medium severity with a CVSS score of 6.9. A fix is available in version 3.5.12-r9.
A SQL injection vulnerability exists in projectworlds Visitor Management System 1.0 within the mysqli_query function of actionpage.php. This flaw allows remote attackers to manipulate the 'purpose' argument to execute arbitrary SQL commands. Exploit code has been published, and the vulnerability has a high severity rating with a CVSS score of 7.3.
A security flaw exists in Stirling-Tools Stirling-PDF versions up to 3.3.0 in the WorkflowParticipantController.getParticipantDetails function. The flaw causes an insufficient session timeout value, which can be exploited remotely. The vendor has not responded to disclosure attempts. The CVSS score is 5.3, indicating a medium severity vulnerability.
IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript into the web user interface. This can alter the intended functionality and potentially lead to credential disclosure within a trusted session.
IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a vulnerability that allows an unauthorized user to inject data into log messages. This occurs due to improper neutralization of special elements when writing to log files, potentially leading to log injection attacks.
A vulnerability in abrt-server allows a local attacker to read environment variables and related metadata of other users' or root processes. This occurs because abrt-server, running as root, trusts a client-supplied process ID (PID) when creating problem dumps over abrt.socket and copies the /proc data of that process into a dump directory owned by the unprivileged user. This flaw enables unauthorized local information disclosure.
Control Web Panel (CWP) versions prior to 1.30.6 have a host header injection vulnerability in the password recovery process. This flaw allows unauthenticated attackers to manipulate the HTTP Host header in the /v1/lostpass/ route, poisoning the reset URL. By tricking an automated mail-security scanner into visiting this malicious link, attackers can exfiltrate the live recovery token, use it to reset the password, and then abuse File Manager and Crontab modules to execute commands under the targeted hosting account.
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands have a vulnerability related to log forging when processing requests to create resources. This vulnerability can allow an attacker with low privileges to manipulate log entries, potentially impacting confidentiality and integrity of logged data. The vulnerability does not affect availability. It has a high severity score of 8.1 according to CVSS 3.1.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a vulnerability that allows an authenticated user with tool-registration privileges to cause a denial of service. This occurs due to uncontrolled regular expression complexity (ReDoS) in the JSON Schema pattern field, which can lead to excessive CPU consumption during argument validation, potentially degrading gateway availability.
Poste Italiane Postecert FIRMAOK! version 1.6.29 on Windows has a local privilege escalation vulnerability due to an uncontrolled OpenSSL search path. The application loads OpenSSL configuration and library files from a hardcoded directory that is user-writable and missing by default. A local attacker with low privileges can create this directory and place malicious files to execute code with the privileges of the user running the application, potentially escalating privileges to full system compromise.
The HashiCorp cap JWT validation library versions before 0.14.0 contain a vulnerability that allows bypassing claims validation. This flaw may cause downstream applications to make authorization decisions based on unvalidated claim values. The vulnerability requires attacker-controlled claims in a JWT signed by a trusted key. It is fixed in version 0.14.0.
IBM Security QRadar EDR versions 3.12 through 3.12.26 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification. This flaw could enable attackers with valid credentials to circumvent multi-factor authentication protections.
IBM Bob version 2.0.3 contains a vulnerability where unauthorized browser extensions can retrieve session tokens through the authentication provider API. The session token is exposed in the account identifier field during account enumeration without requiring explicit user consent. This exposure could allow malicious extensions to access sensitive session information. The vulnerability has a low CVSS score of 3.3, indicating limited impact. No patch or remediation information is currently available.
IBM Security QRadar EDR versions 3.12 through 3.12.26 contain an improper access control vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality.
Control Web Panel (CWP) versions before 1.30.6 have an authorization bypass vulnerability in the validate() function of api/v1/index.php. This flaw allows attackers possessing a password-recovery token and a predictable legacy signature to gain remote API authorization without a valid API key. Exploitation via the POST /cronjobsusers/ endpoint enables attackers to add arbitrary cron commands, resulting in command execution under the affected hosting account. Additionally, attackers can access global account lists and details, exposing sensitive user information including usernames, contact emails, and password hashes.
A vulnerability exists in dbus when configured with the nonce-tcp transport, allowing an unauthenticated attacker to cause a denial of service (DoS) by opening a connection and withholding the expected authentication token. This stalls the server's accept process, blocking legitimate clients from connecting. The issue arises because the server does not enforce a timeout during authentication verification. Default installations are not affected as they use local UNIX domain sockets. Exploitation requires explicit configuration of the nonce-tcp transport and network exposure.
IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a vulnerability that could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context. The vulnerability has a low severity score and does not impact confidentiality or availability but may cause limited integrity issues.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a stack buffer overflow vulnerability in the QFileSvr.400 file system due to improper bounds checking. A local authenticated attacker could exploit this by sending a crafted command to cause undefined behavior.