CVE-2026-116603 is a medium severity vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves an unrestricted file upload flaw in the admin/add_food.php script, where manipulation of the 'image' argument allows remote attackers with high privileges to upload files without restriction. Exploit code has been published, but there is no indication of active exploitation in the wild. No patch or official fix information is currently available.
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as `params` or `dag_run.conf` into `environment`, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.
CVE-2026-110158 is a use-after-free vulnerability in the Chromium component related to password handling. This flaw affects Chromium versions prior to 155.0.4283.60. The issue has been addressed in version 155.0.4283.60.
YesWiki versions before 4.7.0 have an SQL injection vulnerability in the despam.php script. The flaw occurs because the 'from' POST parameter is escaped but used in an unquoted INTERVAL position, allowing authenticated administrators to inject SQL commands. This can lead to blind database reads, including extraction of user password hashes. The vulnerability is fixed in version 4.7.0.
YesWiki versions prior to 4.7.0 contain a server-side request forgery (SSRF) vulnerability in the Bazar CSV import function copyUrlToLocalFile(). Authenticated administrators can exploit this by supplying crafted URLs in CSV or image fields, enabling arbitrary outbound requests. This includes bypassing extension checks via query strings or redirects to access cloud metadata credentials, internal services, or local files. The responses are stored in a web-accessible directory, increasing exposure risk. The vulnerability is fixed in version 4.7.0.
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
YesWiki versions from 4.6.2 up to but not including 4.7.0 have a vulnerability in the HttpSignatureService::verifySignature() method where replay protection is missing. This allows attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint to replay that request later, potentially re-executing sensitive actions such as Delete, Update, Follow, or Undo.
YesWiki versions prior to 4.7.0 contain a stored cross-site scripting (XSS) vulnerability in the referrers_sites.php handler. This flaw allows unauthenticated attackers to inject malicious scripts via crafted Referer headers. The injected scripts execute in the context of any user visiting the referrer-sites page, potentially enabling same-origin authenticated actions. The vulnerability is fixed in version 4.7.0.
YesWiki versions before 4.7.0 have a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject JavaScript by manipulating query parameters that correspond to missing Bazar field names. The vulnerability arises because the application falls back to unsanitized user input rendered with Twig |raw templates, enabling execution of malicious scripts in the context of authenticated users. The issue is fixed in version 4.7.0.
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.
YesWiki versions prior to 4.7.0 contain a vulnerability in the AclService::updateRequestWithACL function where usernames are interpolated into SQL LIKE patterns without properly escaping wildcard characters. This allows self-registered attackers to bypass read access controls by using usernames with wildcard characters such as _ or %, enabling unauthorized reading of restricted pages and Bazar entries via the public Bazar listing API. The issue is fixed in version 4.7.0.
YesWiki versions from 4.6.0 up to but not including 4.7.0 have an information disclosure vulnerability. Unauthenticated attackers can exploit this flaw by adding the 'showreq' parameter to public Bazar listing API requests. This allows them to view assembled SQL queries, revealing sensitive information such as table names, JSON storage paths, ACL filter logic, and collation details. This information can facilitate targeted SQL injection attacks. The vulnerability is fixed in version 4.7.0.
OpenPanel versions prior to 3.0.0 have an information disclosure vulnerability that allows read-level project members to access plaintext integration secrets. This occurs because the notification.rules query does not redact sensitive integration data, exposing Slack bot tokens, webhook URLs, and authorization headers. The vulnerability is fixed in version 3.0.0.
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
OpenPanel versions prior to 3.0.0 have a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard on the worker HTTP port. This access enables attackers to query queue data and invoke APIs to add, retry, or clean jobs, as well as read metrics and datastore health information.
OpenPanel versions prior to 3.0.0 have an improper escaping vulnerability in the sankey.service.ts component. Authenticated project members can exploit this by submitting crafted event names containing backslashes, which break ClickHouse string literals. This causes parse errors that disable the Sankey chart endpoint for the project.
OpenPanel versions before 3.0.0 have a vulnerability that exposes sensitive information by logging database connection URLs and email template data to standard output logs. This includes database credentials and password-reset tokens when certain environment variables are unset. The issue is fixed in version 3.0.0.
OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.
OpenPanel versions before 3.0.0 have a SQL injection vulnerability in the profileColumnAccess function within cohort.service.ts. This flaw allows project-read members to inject SQL by providing unescaped profile filter column names. Exploitation can enable attackers to execute subqueries within cohort.preview filters, potentially reading data from other tenants' ClickHouse databases. The vulnerability is fixed in OpenPanel version 3.0.0.
OpenPanel versions before 3.0.0 have a sandbox escape vulnerability in the JavaScript runtime validator. This flaw allows a project member with write access to bypass the AST allowlist by aliasing the Function constructor, enabling arbitrary code execution in the worker process. The vulnerability is fixed in version 3.0.0.