CVE-2026-107858 is a high-severity vulnerability in Google Agent Development Kit (ADK) for Java versions before 1.13.0. It involves missing origin validation in WebSockets and permissive cross-domain policies, allowing remote attackers to control a locally running agent via malicious web pages. The vulnerability affects the /run_live WebSocket endpoint and REST API, which accept connections and requests from any origin by default. This enables cross-origin attacks that can trigger tools, stream responses, and manipulate sessions and artifacts. The issue is fixed in version 1.13.0 by enforcing same-origin policies and rejecting DNS-rebinding requests over loopback.
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
Part-DB-server versions prior to 2.13.3 contain a vulnerability in the password recovery mechanism where the reset link URL is constructed from an unvalidated client-supplied Host header. This allows an unauthenticated attacker to craft a password reset email with a malicious hostname embedding a valid reset token. When the victim clicks the link, the attacker can capture the token and use it to reset the victim's password, including the seeded admin account, resulting in full administrative takeover. The issue is patched in version 2.13.3.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability that allows authenticated users to bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This can lead to uncontrolled resource consumption by storing files larger than the configured limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of SVG files. The server relies on the file extension rather than actual content type to sanitize SVG uploads, allowing authenticated attackers to upload malicious SVG files with JavaScript payloads using non-SVG extensions. When users view these attachments inline, the embedded script executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.
Part-DB-server versions prior to 2.12.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-controlled Part names are rendered using Twig's |raw filter without proper neutralization, allowing injection of arbitrary HTML elements into the BOM validation result page. Although JavaScript execution is blocked by the Content Security Policy, attackers can still inject HTML links, forms, images, and CSS UI elements. The vulnerability is fixed in version 2.12.2.
Part-DB-server versions prior to 2.12.1 contain a hard-coded APP_SECRET value in the .env file committed to the public repository. This secret is used by the Symfony framework to sign remember-me cookies. Because the official Docker image does not override or randomize this secret at startup, an attacker who obtains it can forge authenticated sessions without credentials. This vulnerability has been fixed in version 2.12.1.
CVE-2026-54630 is a critical vulnerability in Part-DB-server prior to version 2.12.1 that allows authenticated users with default user privileges to upload .phar files to a web-accessible directory. The upload handler fails to block .phar extensions, which are executed as PHP due to the default Apache configuration routing .phar files to PHP-FPM. This leads to remote code execution as the web server user. The issue is patched in version 2.12.1.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
CVE-2026-115638 is a medium severity vulnerability in OpenStack Ironic up to version 39.0.1. It involves improper handling of highly compressed data, specifically a denial of service caused by a configdrive that expands into a very large amount of uncompressed data (a gzip bomb). This can lead to resource exhaustion and service disruption.
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation. This manipulation of the argument url_route causes open redirect. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-19678 is a high-severity server-side request forgery (SSRF) vulnerability in onPhase Forms version 11.0.14. It allows an unauthenticated remote attacker to supply a malicious URL to a publicly accessible form, enabling access to sensitive internal Apache Solr data. The vulnerability affects the unauthenticated form service component. No patch or remediation details are provided in the available data.