Zammad versions prior to 7.1.2 contain a stored cross-site scripting (XSS) vulnerability in the new Vue-based ticket interface. Authenticated users can inject markup into ticket articles that is rendered without proper output encoding when viewed by others. The default Content Security Policy (CSP) reduces the practical impact of this vulnerability. The classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.
A stack-based buffer overflow vulnerability exists in the OpenThread Border Router Neighbor Discovery packet handler of Espressif's ESP-IDF framework versions 5.2.0 through 5.2.7, 5.3.0 through 5.3.5, 5.4.0 through 5.4.4, 5.5.0 through 5.5.4, and 6.0.0 through 6.0.2. The flaw arises from trusting an attacker-controlled ICMPv6 option length, leading to an out-of-bounds write into adjacent stack memory. This affects firmware with the Border Router feature enabled (CONFIG_OPENTHREAD_BORDER_ROUTER=y). Exploitation requires no authentication or user interaction and can cause device crashes, reboots, or stack corruption. Fixed in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3.
CVE-2026-121931 is a critical OS command injection vulnerability in the Linksys WRT54GL router firmware version 4.30.18. The flaw exists in the Traceroute Diagnostic Function's apply.cgi file, specifically in the system function handling the traceroute_ip argument. This vulnerability allows remote attackers to execute arbitrary OS commands. The exploit code has been publicly disclosed. The product is no longer supported by the vendor, and no patch or vendor response is available.
DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.
DataGerry versions prior to 3.3.0 have a server-side template injection vulnerability that allows authenticated users with specific permissions to inject and execute arbitrary Jinja2 payloads. This vulnerability enables remote code execution as the web process user, which is root by default in Docker deployments.
A cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). This flaw allows an unauthenticated remote attacker to execute arbitrary script code by tricking a user into clicking a crafted link. The vulnerability arises from improper validation of user-supplied input in the interface.
A vulnerability in the ScopingHttpClient component of Symfony HttpClient allows credentials from a default scope to be sent to an attacker-controlled server when a network-path reference URL is resolved outside the base URI's origin. This occurs in Symfony versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The issue arises because merged options like auth_bearer or auth_basic are retained even when the resolved URL points to a different origin, potentially exposing sensitive credentials.
A vulnerability in the web-based management interface of Cisco UCS Central Software allows an authenticated remote attacker to execute arbitrary commands, write files, or disclose sensitive information. The flaw arises from insufficient validation of user input in HTTP requests. Exploitation requires valid user credentials. Cisco has released software updates to fix this issue, and no workarounds are available.
The GetPaid plugin for WordPress versions before 2.8.63 has an input validation vulnerability that allows unauthenticated attackers to bypass payment processing. By submitting a negative item quantity on a public payment form, attackers can reduce the invoice total to zero, causing the system to mark the invoice as paid without charging the payment gateway.
The GetPaid plugin for WordPress versions prior to 2.8.63 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access and manipulate invoices belonging to other users by exploiting the maybe_use_invoice parameter. By supplying a known pending invoice ID, attackers can read checkout pricing details and change the invoice status to on-hold without proper authorization.
A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated remote attacker to obtain an endpoint identity certificate by bypassing authorization checks. This issue arises from improper authorization validation and can be exploited by sending a crafted request to the affected device. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Certain Yealink terminal devices released before April 21, 2026, have an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This vulnerability allows unauthorized users to access 802.1X network authentication credentials. Yealink has addressed this issue in the latest firmware by restricting modification privileges of the 802.1X configuration to administrator accounts only by default.
Certain Yealink products released before April 15, 2026, have a vulnerability in their Wi-Fi AP function where a default 8-digit numeric pre-shared key (PSK) with insufficient strength is used. This weak PSK can be brute-forced by attackers to gain unauthorized network access and intercept Wi-Fi traffic. The vulnerability has a high severity score of 7.4 and impacts confidentiality but not integrity or availability.
A server-side request forgery (SSRF) vulnerability exists in InfiniFlow RAGFlow up to version 0.27.3 in the _account_get function of the Seafile Connector component. This vulnerability allows remote attackers to manipulate the seafile_url argument, potentially causing unauthorized requests from the server. The vulnerability has a CVSS score of 6.3 (medium severity). Public exploit code has been disclosed, but no vendor response or patch is currently available.
A vulnerability in GNU C Library versions 2.18 through 2.31 causes the iconv converter to hang when converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding. This results in the calling application becoming unresponsive.
A vulnerability in the WebMvcConfig.addInterceptors function of the yezhihao jt808-server component Web Management API allows remote attackers to bypass authentication. The product uses a rolling release model, so no specific affected or fixed versions are identified. Public exploit code is available. The vendor has not responded to disclosure attempts.
FreeRDP versions before 3.32.2 have a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel. This flaw allows malicious RDP servers to cause the client to access freed memory by closing the channel while audio PDUs are queued. The vulnerability can lead to client crashes due to playback thread accessing freed callbacks.
Parse Server versions before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contain a prototype pollution vulnerability affecting Cloud Code triggers and LiveQuery. This flaw allows clients with write access to corrupt built-in functions by exploiting dot notation keys that traverse inherited members, causing denial of service until the server is restarted.
FreeRDP versions before 3.32.2 have a denial of service vulnerability in the NLA-enabled shadow server. This occurs when a CredSSP TSRequest omits negoTokens, allowing unauthenticated attackers to send a crafted seven-byte TSRequest that triggers a fatal assertion and crashes the server process.
FreeRDP versions prior to 3.32.2 contain a heap-based buffer overflow vulnerability in the RD Gateway RPC client. This occurs because the client incorrectly checks only total capacity rather than remaining capacity when writing certain RPC fragments, allowing a malicious RD Gateway to overwrite client heap memory. Exploitation can cause application crashes or potentially allow arbitrary code execution.