Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Lago versions up to 1.55.0 have an authentication bypass vulnerability in the acceptInvite mutation. This flaw allows organization administrators to obtain session tokens for existing accounts without password verification. Exploitation enables attackers to access sensitive organizational data including billing, API keys, and payment integrations by inviting a victim's email and accepting with any password.
CVE-2026-119419 is a critical SQL injection vulnerability in CakePHP versions up to 5.4.3. It arises from improper neutralization of special elements in SQL commands, specifically through unvalidated collation values supplied to StringExpression and IdentifierExpression. Attackers can inject arbitrary SQL by manipulating the collation name, potentially affecting all database drivers accessible by the connection.
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
CVE-2026-119416 is a vulnerability in CakePHP up to version 5.4.3 involving improper cookie domain validation in the Http Client CookieCollection. This flaw allows malicious servers to exploit unanchored suffix matching to receive and plant cookies improperly. Attackers controlling domains with suffixes matching victim domains or sending Set-Cookie Domain values for unrelated hosts can steal or inject cookies into client cookie jars.
CVE-2026-119415 is a header injection vulnerability in CakePHP versions up to 5.4.3. It allows attackers to inject MIME part headers by supplying CR/LF sequences in Content-Type and Content-ID values used in attachments or multipart HTTP client data. This can lead to arbitrary headers or content being added to MIME parts.
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
n8n versions prior to 2.42.6, 2.43.3, and 3.0.1 contain a remote code execution vulnerability due to improper isolation of certain deprecated nodes. Authenticated users able to create or modify workflows with these nodes can execute JavaScript in the main n8n process, leading to high-severity impact.
Element Web and Element Desktop versions before 1.12.32 have a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows remote unauthenticated attackers to log out users and clear local storage by exploiting guest credentials passed via URL fragment parameters. Attackers can trick logged-in users into opening specially crafted links that force an attacker-controlled guest session, resulting in the destruction of unbacked end-to-end encryption keys.
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
SQLite versions prior to 3.54.0 contain an authorization bypass vulnerability in the lookupName() function. This flaw causes the authorizer callback to be invoked only for the first joined table's USING column, allowing attackers who can submit SQL to bypass SQLITE_READ restrictions on shared USING columns in RIGHT or FULL JOIN queries.
SQLite versions prior to 3.54.0 contain a stack exhaustion vulnerability due to uncontrolled recursion triggered by chaining COLLATE postfix operators. This allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by supplying approximately 175,000 chained COLLATE operators in SQL statements or untrusted database views, causing unbounded recursion in the sqlite3WalkExprNN() function and crashing the process.
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
CVE-2026-119373 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0 when built with FTS5 enabled. The flaw occurs in the fts5MergeRowidLists() function, which undersizes the output buffer during merging of detail=none prefix doclists. An attacker able to insert negative rowids into a detail=none FTS5 table and execute a prefix MATCH query can trigger out-of-bounds writes, leading to heap corruption and process crashes.
CVE-2026-119372 is a use-after-free vulnerability in SQLite versions prior to 3.54.0 when built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS enabled. The flaw exists in the fts3BestSnippet() function due to dangling cached position-list pointers. An attacker can exploit this by running a full-text MATCH query combining OR and NEAR operators with snippet(), potentially causing the process to read freed heap memory and crash.
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.