VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
CVE-2026-115417 is a high-severity vulnerability in the AWS aws-c-mqtt library before version 0.16.2. It involves memory allocation with an excessive size value in the MQTT 3.1.1 compatibility adapter, which could allow a remote attacker to cause a denial of service (DoS) of the client application. The issue is fixed in aws-c-mqtt version 0.16.2 and later. Users should upgrade to these versions or to an AWS Common Runtime or AWS IoT Device SDK release that includes the fix.
Capcom has confirmed a data breach impacting its CAPCOM ID membership service, resulting in the exposure of over 11.7 million customer email addresses and associated information. The breach affects a large number of users but specific technical details and the nature of the exposed information beyond email addresses have not been disclosed.
A vulnerability in the A2A server component of Amazon Strands Agents SDK for Python before 1.43.0 and TypeScript before 1.5.0 allows an authenticated remote user to access other tenants' conversation history and modify model behavior by exploiting improper isolation of conversation state between callers.
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
Jitsu versions before 2.14.0-beta.41 have an incorrect authorization vulnerability in the sources/state.ts handlers. The issue arises because the syncId ownership check is bypassed due to asynchronous handling errors, allowing authenticated users who know another workspace's sync ID to read, overwrite, or delete its stream cursors. This can lead to data re-ingestion or skipped data. The vulnerability has a low CVSS score of 2.3.
Crawl4AI versions from 0.7.0 up to but not including 0.9.5 contain a vulnerability involving inefficient regular expression complexity in the Docker API server. Authenticated API clients can submit specially crafted unbounded regular expressions in /crawl request bodies, causing catastrophic backtracking. This can freeze the entire server, including the /health endpoint, leading to denial of service.
Vikunja versions 2.2.0 up to but not including 2.7.1 contain an HTML injection vulnerability in the CreateConversationalHeader function. This flaw allows authenticated users to inject malicious HTML, including phishing links, into notification emails by crafting display names or task/project titles that break out of email anchor tags. The vulnerability affects task-comment and task-mention notification emails sent to project members.
libsmb2 versions before 6.3 contain integer overflow vulnerabilities in the DCE/RPC NDR decoder. These flaws allow heap out-of-bounds reads and writes when processing crafted NetrShareEnum replies, potentially leading to heap memory corruption. The issue can be triggered by a malicious SMB server or a man-in-the-middle on unsigned connections during smb2_share_enum_async() calls.
CFITSIO versions up to 4.7.0 contain an out-of-bounds write vulnerability in the ffgcls2() function. This flaw arises from trusting attacker-controlled heap descriptor lengths for variable-length string columns, allowing a crafted FITS file to overflow a fixed stack buffer and the caller's string array. The vulnerability can lead to arbitrary code execution.
Ghidra versions before 12.2 have a vulnerability in the ExtensionUtils.unzipToInstallationFolder() function that improperly handles highly compressed data. This flaw allows attackers to craft zip bomb extension archives that expand without size limits, potentially exhausting disk space. This can cause failures in subsequent writes by Ghidra and other applications. The vulnerability requires user interaction to install a malicious extension archive.
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
Ghidra versions before 12.2 have a vulnerability in the ExtensionUtils.unzipToInstallationFolder() function where ZIP entries are extracted without limiting the number of files. This can lead to exhaustion of filesystem inodes if a user installs a maliciously crafted extension archive containing many files, causing failures in project writes and other processes.
Ghidra versions 10.3 up to but not including 12.2 contain a vulnerability in the ThemeReader.processIconFile() function where highly compressed data is improperly handled. This flaw allows crafted theme ZIP files with icon entries that decompress to very large sizes, potentially filling the host filesystem and causing subsequent write operations to fail. The vulnerability requires user interaction to import the malicious theme file. The CVSS 4.0 base score is 6.8, indicating a medium severity level.
Ghidra versions 10.3 up to but not including 12.2 have a vulnerability in the ThemeReader.readZipTheme() function where importing a crafted theme ZIP archive with many small files can exhaust disk inodes and space, causing a denial of service. This occurs due to resource allocation without limits or throttling during theme extraction. The vulnerability requires user interaction to import the malicious theme archive.
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.