MrDoc versions through 1.1.1 have a missing authorization vulnerability in the get_doctemp view. Authenticated users can exploit this flaw to read document templates belonging to other users by enumerating the sequential doctemp_id POST parameter. This allows unauthorized access to private template content.
Keyfactor EJBCA versions through 9.3.3 have a vulnerability where insufficient authorization checks occur during client certificate self-renewal via the RA User Interface. An authenticated remote user with a valid client certificate and RA UI access can renew their certificate even if policy or profile settings should prevent it.
Chatify versions before 1.6.4 have an authorization bypass vulnerability in the Pusher channel authorization endpoint. This flaw allows authenticated users to subscribe to private channels of other users by supplying arbitrary channel names. Exploiting this, an attacker can receive the victim's incoming private messages and attachments in real time.
OpenCSG CSGHub versions through 2.6.0-ce have an authorization bypass vulnerability in an unauthenticated file resolve route. This flaw allows remote attackers to read private repository files by injecting a percent-encoded current_user parameter into the file path. The portal forwards this request with its server API key, enabling unauthorized access to private model, code, or space repositories.
A vulnerability in inih before revision 63 allows a one-byte stack buffer under-read in the ini_parse_stream() function. This occurs when an attacker supplies an INI file or string containing a line of at least INI_MAX_LINE-1 bytes followed by an embedded NUL byte, leading to reading memory out-of-bounds. The issue causes undefined behavior detected by memory sanitizers but does not impact confidentiality or integrity.
A missing authorization vulnerability exists in Product Gallery Slider & Additional Variation Images for WooCommerce versions 2.3.23 up to but not including 2.3.26. This flaw affects Codestar backup AJAX actions (csf-export, csf-import, csf-reset), allowing Shop Managers to exploit the csf_backup_nonce from the settings page and manipulate WordPress options arbitrarily, including wp_user_roles. This can lead to privilege escalation to administrator.
Warracker versions before 1.0.4 have a missing authorization vulnerability in their Paperless-ngx integration. This flaw allows authenticated users without administrative privileges to bypass document ownership restrictions. By exploiting insufficient authorization checks in specific route handlers, an attacker can access private documents of other users through the shared Paperless-ngx API credential, leading to unauthorized disclosure of confidential information.
Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3 contain an improper isolation vulnerability. An administrator with sufficient entitlements can import BPMN process definitions via the REST API and start them. If the BPMN process includes a JUEL expression, it is executed directly on the server without sandboxing, potentially leading to unsafe execution of expressions. Versions 4.0.9 and 4.1.4 address this issue by rejecting BPMN definitions that include expression attributes.
An out-of-bounds read vulnerability exists in the Apache Arrow Rust 'arrow' crate affecting versions from 33.0.0 through 57.3.1, 58.4.0, 59.3.1, and 60.0.0. The flaw arises from improper validation of RunEndEncoded arrays in the ArrayData interface, which can lead to reading data beyond the bounds of the child values array. This issue is fixed in versions 57.3.2, 58.4.1, 59.3.2, and 60.1.0.
An SQL injection vulnerability exists in Apache Syncope due to improper neutralization of special elements in SQL commands. This issue is an incomplete fix of a previous vulnerability (CVE-2026-77051) and allows an administrator with sufficient entitlements to execute arbitrary SQL commands via unsanitized opEvent parameters. The vulnerability affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Users are advised to upgrade to versions 4.0.9 or 4.1.4 where the issue is fixed.
Apache Syncope contains an improper isolation vulnerability that allows an administrator with certain entitlements to execute untrusted Groovy code on a separate thread, bypassing the Groovy security sandbox. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrading to versions 4.0.9 or 4.1.4 addresses this issue.
An authorization bypass vulnerability exists in Apache Syncope allowing a delegated administrator to relocate a Realm subtree across administrative realm boundaries without proper permission. This affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrading to versions 4.0.9 or 4.1.4 resolves this issue.
A SQL injection vulnerability exists in the Starnet Computer and Network Systems Inventory Tracking Application through 2026-10-16. This flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries.
An improper privilege management vulnerability in Apache Syncope allows non-admin users to configure impersonation for WA surrogate authentication via AuthProfile self-updates. This affects versions from 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrading to versions 4.0.9 or 4.1.4 resolves the issue.
A stored cross-site scripting (XSS) vulnerability exists in the Mega Menu Badge Text feature of the Helix Ultimate Joomla extension versions prior to 2.2.11. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw is identified as CVE-2026-105602 and has a high severity rating with a CVSS score of 8.6.
A Missing Authorization vulnerability (CVE-2026-92886) exists in TÜBİTAK BİLGEM Software Technologies Research Institute's eta-register software, affecting versions from 2.0.8 up to but not including 2.0.9. This vulnerability allows privilege escalation due to improper authorization checks.
Dell OpenManage Enterprise versions prior to 4.8.0 have a vulnerability involving improper neutralization of argument delimiters, which could allow a low privileged attacker with adjacent network access to execute commands. The vulnerability is classified as medium severity with a CVSS score of 4.6. No public exploits or patches are currently documented.
Dell OpenManage Enterprise versions prior to 4.8.0 have an improper verification of cryptographic signature vulnerability. This flaw allows a high privileged attacker with adjacent network access to potentially execute code on the affected system. The vulnerability has a medium severity rating with a CVSS score of 5.7. No specific affected versions were explicitly stated beyond 'prior to 4.8.0'. There is no information about available patches or vendor advisories in the provided data.
A high-severity remote code execution (RCE) vulnerability exists in the Joomla extension StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. The flaw involves setting strings that can lead to code execution. This vulnerability is tracked as CVE-2026-105600 with a CVSS 4.0 base score of 8.6.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Joomla extension php-web-design.com StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. This vulnerability allows unauthorized actions to be performed via CSRF attacks.