Webmin versions up to 2.670 have a file injection vulnerability in the acl/cert_issue.cgi component. Authenticated users can exploit this by injecting newline characters in certificate DN fields, allowing them to add a root entry with a known password hash. This can lead to full root access after the miniserv service restarts.
Traccar versions from 3.15 up to but not including 6.17.0 contain an authentication bypass vulnerability in the LdapProvider.login() function. This flaw allows unauthenticated attackers who know a valid username to log in with an empty password if the LDAP directory permits unauthenticated binds. This can lead to unauthorized access to any account, including administrator accounts.
Wallos versions from 4.4.0 up to but not including 5.10.3 contain a stored cross-site scripting (XSS) vulnerability in the sendnotifications.php endpoint. This flaw allows registered users to inject malicious scripts through unescaped notification service responses. An attacker can exploit this by directing Mattermost webhook URLs or Web Push endpoints to a server under their control that returns JavaScript. When an administrator opens sendnotifications.php, the injected script executes in their session, potentially compromising confidentiality and integrity.
OpsTree REMS versions through 1.0.0 have a missing authentication vulnerability that permits unauthenticated remote attackers to access Governance API endpoints. Attackers can exploit this by sending requests without valid Authorization headers or with tampered JWT tokens, allowing them to retrieve sensitive database credentials such as hosts, usernames, and passwords.
OpsTree REMS versions through 1.0.0 have an improper attribution vulnerability that allows authenticated users with lower privileges to post comments as if they were the incident creator. This occurs via the POST /api/v1/incidents/{incident_id}/comment endpoint. Attackers can impersonate higher-privileged users, such as Super Users, thereby corrupting the incident timeline and audit trail.
OpsTree REMS versions up to 1.0.0 have a server-side request forgery (SSRF) vulnerability that allows authenticated users to make the backend server connect to arbitrary destinations via the database Test Connection feature. This can be exploited by setting a database entry's host and port to internal or attacker-controlled addresses, enabling probing of internal hosts and ports accessible from the REMS server.
OpsTree REMS versions through 1.0.0 have an improper authorization vulnerability that allows authenticated users to change the reporter of an incident to another user. This is done by supplying a client-controlled reporter field in POST or PATCH requests, enabling falsification of incident attribution and corruption of the accountability audit trail.
SiYuan versions 3.7.0 up to but not including 3.8.10 on Windows contain a path traversal vulnerability in the kernel/util/webfetch.go component. This flaw allows attackers to write files outside the intended import directory by using backslash-encoded sequences in filenames. Specifically, attackers controlling URLs fetched by the MCP web_fetch or http_request tools can exploit %5C-encoded ..\ sequences to write arbitrary response data to directories above the temp/import folder that are writable by the SiYuan user.
OpsTree REMS versions through 1.0.0 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to obtain valid JSON Web Tokens (JWTs) by manipulating the client-controlled is_local_auth field. By sending a specially crafted POST request to /api/v1/user/login/ with the admin username, an invalid password, and is_local_auth set to true, attackers can gain SuperUser administrative access.
@tinacms/mdx versions before 2.4.2 have a code injection vulnerability in the MDX serializer. This flaw allows authenticated content editors to inject crafted values into MDX expressions without proper escaping, potentially leading to JavaScript execution in visitors' browsers or during build and server-side rendering.
OpsTree REMS versions through 1.0.0 have a prompt injection vulnerability that allows authenticated users to disclose hidden system prompts by submitting crafted input to the chat API endpoint. This flaw enables attackers to bypass assistant rules and reveal internal orchestration instructions, potentially facilitating further prompt injection attacks.
OpsTree REMS versions through 1.0.0 have a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can exploit this by uploading attachments with a spoofed text/html Content-Type, such as HTML files disguised with double extensions (e.g., test.html.pdf). When these files are previewed in the REMS application, the embedded JavaScript executes in the context of the victim's browser.
Social-auth-core versions from 4.7.0 up to but not including 7.0.0 contain a login cross-site request forgery (CSRF) vulnerability in the SAML backend. This flaw allows attackers to craft a valid Identity Provider (IdP) response and RelayState parameter that is unsigned, which can be delivered to a victim's browser via an auto-submitting form. Exploitation results in the victim being logged into the attacker's account, enabling the attacker to capture any data the victim enters during the session.
A vulnerability in Node.js allows a client authorized for the default hostname to bypass per-host mutual TLS (mTLS) authorization and access a protected hostname it is not authorized for. This occurs when a TLS server configures a hostname with a client-certificate CA but no server certificate, causing the client CA to fall back to the default. As a result, a client trusted by the default CA can complete mTLS to the protected hostname despite lacking proper authorization. This affects Node.js versions 22.x, 24.x, and 26.x.
A use-after-free vulnerability exists in Node.js HTTP/2 when serving files using respondWithFile() or respondWithFD(). An unauthenticated client can cause the server to free an Http2Stream object while a write operation referencing it is still queued, leading to a dereference of freed memory. This affects Node.js versions 26.x starting from 26.9.0 and 24.x starting from 24.22.0. The vulnerability can be triggered over both TLS and cleartext connections.
A NULL pointer dereference vulnerability in Node.js HTTP/2 allows an unauthenticated client to crash the server by cancelling file downloads. This affects Node.js versions 22.x, 24.x, and 26.x. The issue occurs when the server uses stream.respondWithFile() or stream.respondWithFD() to serve files, and the client cancels the request, causing a StreamPipe to be torn down improperly and leading to a NULL pointer dereference that aborts the process. No special crafted frames are required to trigger the crash.
A vulnerability in Node.js TLS allows a client to bypass client certificate authentication by changing the servername during TLS 1.2 renegotiation. This enables a client authenticated for a less restrictive host to access endpoints with stricter client-certificate policies, effectively bypassing intended access controls. The issue affects Node.js versions 22.x, 24.x, and 26.x.
A use-after-destroy vulnerability exists in Node.js TLS server handshake handling when using certain OpenSSL callbacks. This flaw allows a remote, unauthenticated attacker to cause the Node.js server process to terminate unexpectedly by sending a specially crafted client hello message followed by a socket FIN. The issue affects Node.js versions 24.x and 26.x and results in an uncaught exception that crashes the server process.
A re-entrancy vulnerability in Node.js HTTPS allows an unauthenticated client to read memory from other connections, potentially exposing TLS private keys and other users' request data. This occurs due to a use-after-free and out-of-bounds heap read triggered by specific sequences of HTTP response handling involving res.flushHeaders() and res.end(). The flaw affects Node.js versions 22.x, 24.x, and 26.x.
An unauthenticated HTTP/2 client can cause a Node.js server to leak memory and file descriptors indefinitely by triggering a protocol error during session shutdown. This leaves sockets in CLOSE_WAIT state and HTTP/2 session state held in memory without release. The issue affects Node.js versions 22.x, 24.x, and 26.x and is a partial regression of a previous fix (CVE-2026-48937).