Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig. An authenticated low-privilege user, including a student, can directly address crafted message content to an administrator because the message creation flow permits a sender to select another user as the recipient. The content executes in the recipient's browser when the recipient opens the routine inbox or message view, without requiring a link click, and can expose session credentials or permit actions as the administrator. This vulnerability is fixed in 2.0.1.
CVE-2026-59341 is a vulnerability in Bitnami sealed-secrets controller affecting unauthenticated POST endpoints. An attacker with internal network access can exploit template rendering in spec.template.data to decrypt sealed secrets by using the controller as a decryption oracle. The vulnerability arises from missing AEAD label binding and side-channel leaks via HTTP response codes. It requires access to the internal service port and affects versions up to 0.38.4.
Chamilo LMS versions 1.11.0 through 1.11.40 and 2.0.0 through 2.0.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts into survey answers by computing deterministic invitation codes and bypassing authorization checks. The injected scripts execute in the browsers of teachers or administrators viewing survey reports, potentially enabling persistent backdoor account creation via the victim's authenticated session.
AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.
An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed.
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
CVE-2026-76785 is a medium severity SQL injection vulnerability in amirsanni Mini-Inventory-and-Sales-Management-System version 0.1. The flaw exists in the Transaction::getAll function within application/models/Transaction.php, where manipulation of the orderBy or orderFormat arguments can lead to SQL injection. The vulnerability can be exploited remotely. Public exploit code is available, but the vendor has not yet responded or issued a fix.
Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.
Statamic CMS versions prior to 5.74.3 and 6.24.2 contain a cross-site scripting (XSS) vulnerability in the default form notification email feature. This vulnerability allows an unauthenticated attacker submitting a form to inject HTML into notification emails sent to recipients. The issue arises because user-submitted values are rendered without proper escaping. Fixed versions 5.74.3 and 6.24.2 address this vulnerability.
Statamic CMS versions prior to 5.74.3 and 6.24.2 allowed unauthenticated users to upload file types via public frontend forms that were not properly restricted, bypassing the Control Panel's file upload restrictions. Although executable file types like .php and .html were blocked by a global allowlist, other disallowed file types could be uploaded and stored on a publicly accessible disk. This vulnerability is fixed in versions 5.74.3 and 6.24.2.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain an authorization bypass vulnerability allowing authenticated Control Panel users to view content from entries they do not have permission to access, including unpublished entries. The vulnerability does not allow modification of data. This issue is fixed in versions 5.74.1 and 6.24.0.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain a vulnerability where user-supplied input incorporated into Antlers templates can lead to unsafe reflection. This flaw allows unauthenticated attackers to manipulate templates, potentially causing loss of content and assets. The vulnerability is fixed in versions 5.74.1 and 6.24.0.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain an improper authentication vulnerability when OAuth login is enabled with providers that do not guarantee verified email addresses. This flaw allows an unauthenticated attacker to sign in as an existing user, including potentially a super admin, without knowing the user's password. The vulnerability arises because the application matches OAuth identities to user accounts solely by email address. This issue is fixed in versions 5.74.1 and 6.24.0.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain a vulnerability where an authenticated Control Panel user can verify the existence of an email address via a user creation wizard endpoint without having permission to view users. This exposure is limited to user existence information and does not disclose other user data. The issue is fixed in versions 5.74.1 and 6.24.0.
CVE-2026-66711 is a high-severity cross-site scripting (XSS) vulnerability affecting WooCommerce Multilingual & Multicurrency versions up to and including 5.5.6. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability requires user interaction (UI:R) but does not require privileges (PR:N) and can impact confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-65570 is an authentication bypass vulnerability affecting the 'Login with phone number' product by Hamid Alinia in versions up to and including 1.8.70. This vulnerability allows unauthenticated attackers to bypass authentication mechanisms by spoofing, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has a high severity with a CVSS score of 8.1. No official patch or remediation guidance has been provided yet.
CVE-2026-28179 is a medium severity Cross-Site Scripting (XSS) vulnerability affecting FiboSearch versions up to and including 1.33.0. It involves improper neutralization of input during web page generation, allowing a shop manager level user to potentially inject malicious scripts. The vulnerability has a CVSS score of 5.9 and impacts confidentiality, integrity, and availability to a limited extent. No official patch or remediation guidance has been provided by the vendor yet.
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.