AdminNeo versions prior to 5.5.1 contain a vulnerability allowing authenticated SQLite users to delete arbitrary files writable by the PHP process via the database-list drop action. The flaw arises because the drop operation does not validate file extensions or restrict deletions to known database files, unlike create and rename operations. An attacker with valid credentials and a CSRF token can submit arbitrary file paths to be unlinked, potentially deleting critical files. This vulnerability is fixed in version 5.5.1.
AdminNeo versions 4.6.0 through 5.5.0 are vulnerable to cookie attribute injection via the unsanitized X-Forwarded-Prefix HTTP header. This allows an attacker who can control or influence this header to inject arbitrary cookie attributes into all Set-Cookie response headers, including session and encryption key cookies. The vulnerability enables session hijacking, credential theft, and session fixation by manipulating cookie scope and attributes. The issue arises from concatenating the X-Forwarded-Prefix header directly into the REQUEST_URI without sanitization and manually constructing Set-Cookie headers without escaping. A fix is available in AdminNeo version 5.5.1.
AdminNeo versions prior to 5.5.1 are vulnerable to a cross-site scripting (XSS) attack due to unsanitized insertion of the MySQL server version string into a script tag with a valid Content Security Policy (CSP) nonce. An attacker controlling a reachable MySQL server can craft a malicious version string that breaks out of the JavaScript context and executes arbitrary code in the victim's browser. This vulnerability requires no authentication when combined with login CSRF. A fix is available in version 5.5.1.
AdminNeo versions prior to 5.5.1 contain a vulnerability in their SQLite interface that allows authenticated users to execute arbitrary code. The application blocks ATTACH queries to prevent arbitrary file creation, but does not block the VACUUM INTO command, which can write the entire database to an arbitrary file path. An attacker can exploit this by injecting PHP code into a table name and then using VACUUM INTO to write a web shell to the web root, enabling remote command execution.
AdminNeo versions prior to 5.5.1 have a vulnerability in their CSRF token implementation that allows an attacker who observes a single CSRF token to recover the session secret instantly and forge unlimited valid CSRF tokens. This flaw arises because the token transmits both the XOR mask and the masked value, enabling trivial secret recovery. The session token entropy is low (~20 bits), making brute-force attacks feasible even without token observation. Exploitation allows attackers to perform unauthorized SQL commands through the victim's session, including creating backdoor users and dropping tables.
The NationalSecurityAgency/emissary package contains a vulnerability in its URL validation logic within NavAction.java. The regex intended to restrict URLs allows protocol-relative URLs (e.g., //evil.com) and single-slash scheme variants (e.g., http:/evil.com) to bypass validation. This flaw enables server-side request forgery (SSRF) and open redirect attacks. The vulnerability affects versions prior to 8.51.0, which includes the commit e2078417464b that introduced the flawed regex. The issue is rated medium severity with a CVSS score of 4.8.
CVE-2026-63414 is an incorrect authorization vulnerability in the Shopify Rails engine 'shopify_app' affecting versions from 22.1.0 up to but not including 23.0.3. The flaw allows token-exchange authenticated controllers to use a request-derived 'shop' context instead of verifying the Shopify ID token or active session identity. This can cause the application to treat a different 'shop' than the one authenticated as current, potentially allowing an attacker with a valid session token for one shop to access or act on data belonging to another shop. The issue is fixed in version 23.0.3.
CVE-2026-63410 is a timing side-channel vulnerability in the secp256k1-native library version 0.17.0 up to but not including 0.18.0. The issue arises from native constant-time scalar multiplication functions compiled with certain GCC versions at optimization level -O2, which reconstruct branchless selection into secret-dependent branches. This leaks timing information about secret scalars, potentially allowing attackers to statistically recover bits of private keys or nonces through repeated timing measurements. The vulnerability is fixed in version 0.18.0.
CVE-2026-63400 is a low-severity vulnerability in the open source review and moderation tool Coop from ROOST. Versions prior to 1.0.2 do not invalidate existing database-backed sessions when a password is reset via the resetPasswordForToken function. This allows an attacker who has compromised a password and established a session to retain access to the account until the session expires, which can be up to 30 days. The issue is fixed in version 1.0.2.
CVE-2026-63398 is an improper authentication vulnerability in roostorg's Coop open source review and moderation tool. Versions prior to 1.0.2 use a SAML strategy that resolves authenticated users by email alone without binding to the organization, allowing an attacker who controls a SAML IdP signing key to impersonate users across organizations sharing the same signing certificate. This enables full cross-tenant account takeover without privileges in the target organization. The issue is fixed in version 1.0.2.
CVE-2026-63401 is an authorization bypass vulnerability in roostorg's open source tool Coop prior to version 1.0.2. The flaw allowed authenticated users with MRT queue-edit permission in one organization to grant or revoke manual review queue access for users in other organizations due to missing organization scoping in certain functions. No confidential data disclosure occurred as the attacker could not read other organizations' queues or jobs. The issue is fixed in version 1.0.2.
CVE-2026-63396 is a vulnerability in roostorg's Coop, an open source review and moderation tool. Versions prior to 1.0.0 allow unauthenticated actors to query the GraphQL API endpoint `/api/v1/graphql` and retrieve sensitive organizational and user data. This includes organization IDs, names, email addresses, website URLs, on-call alert emails, and detailed user information such as IDs, emails, names, roles, permissions, and creation dates. The issue is resolved in version 1.0.0.
CVE-2026-63399 is a vulnerability in roostorg's open source tool Coop prior to version 1.0.0. The GraphQL Mutation.createOrg operation allows unauthenticated users to create arbitrary organizations on publicly accessible instances. This can generate excessive log noise and, due to lack of rate limiting, may lead to database exhaustion. The issue is resolved in version 1.0.0. Running the service on an authenticated private network can mitigate exposure by preventing unauthorized external access to the GraphQL API.
CVE-2026-63402 is a vulnerability in the i18next JavaScript internationalization framework prior to version 26.3.4. It involves the `deepExtend` function improperly recursing into inherited built-in objects via the `in` operator, allowing an attacker to overwrite properties of shared built-in functions process-wide when specific parameters are used. This can cause unrecoverable denial of service by making functions like `hasOwnProperty` non-callable. The issue is fixed in version 26.3.4.
CVE-2026-63339 is a high-severity vulnerability in inex IXP-Manager prior to version 7.3.0 that allows an authenticated, non-administrative user to escalate privileges to administrator status. This improper input validation flaw enables unauthorized access to administrative functions. The issue is resolved in version 7.3.0.
CVE-2026-63338 is an authorization vulnerability in inex IXP-Manager versions prior to 7.3.0. Authenticated users could view and edit API key resources belonging to other users due to insufficient authorization checks in the ApiKeyController. This flaw allows unauthorized access and modification of another user's API key. The issue is resolved in version 7.3.0.
CVE-2026-63393 is a high-severity vulnerability in OpenSearch SQL affecting versions from 2.8.0.0 up to but not including 2.19.6.0, and from 3.0.0.0-alpha1 up to but not including 3.7.0.0. It allows a remote authenticated user with basic read/search permissions to exploit unsafe deserialization of untrusted data via the `cursor` parameter in the `plugins/sql` endpoint, leading to arbitrary code execution on the server. The issue is fixed in versions 2.19.6.0 and 3.7.0.0.
CVE-2026-63378 is a code injection vulnerability in TAKO AI Agent for Okta versions prior to 3.0.1-beta. Authenticated users with a valid session cookie can submit arbitrary Python code via a specific API endpoint, bypassing content filtering due to incomplete validation of dynamic code constructs. The injected code is executed with root privileges in the default container, risking full container compromise, exposure of sensitive environment secrets, and backend pivoting. The issue is fixed in version 3.0.1-beta.
CVE-2026-63377 is a critical authentication bypass vulnerability in TAKO AI Agent for Okta versions prior to 3.0.1-beta. It allows an unauthenticated network attacker to create the first administrator account by accessing the POST /api/auth/setup endpoint before the legitimate owner completes initial setup. The flaw arises because the setup endpoint does not require authentication or a bootstrap token and is exposed on all network interfaces by default. Exploitation grants full administrative control, enabling data access, user and configuration modification, and denial of legitimate setup. The issue is fixed in version 3.0.1-beta.
CVE-2026-63346 is a code injection vulnerability in the christianhelle refitter tool prior to version 2.1.2. The flaw arises because header parameter names in OpenAPI specifications are inserted verbatim into C# attribute strings without escaping quotation marks. This allows an attacker to inject malicious code that executes at assembly load time via a [ModuleInitializer] method, even if the generated client is never called. The issue is fixed in refitter version 2.1.2.