Dental practice websites hosted with iDentalSoft were found to expose sensitive information via JSON responses on certain pages. This data leakage included OAuth credentials, password hashes, and personally identifiable information (PII). The vulnerability has been addressed and fixed in iDentalSoft version 14.0.3.
Omnispace Agora Project versions through 26.10.0 have a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL via the personsSort session value. This value is used unsanitized in ORDER BY clauses in MdlUser.php and MdlSpace.php. Exploitation can leak database information such as the MariaDB version through error-based payloads on user and space listing pages.
Omnispace Agora Project versions through 26.10.0 have a vulnerability in token generation where the shared-calendar iCal share token can be predicted and forged by unauthenticated attackers. This is due to the token being derived from predictable fields such as object creation time, which is disclosed in the calendar metadata. Exploiting this allows unauthorized reading of shared calendar iCal feeds.
A vulnerability in dnf5daemon-server allows unauthenticated local users to invoke root-privileged commands via D-Bus methods that accept caller-controlled URLs or RPM path patterns. This can lead to disclosure of privileged content through a world-readable cache and denial of service by exhausting disk space. Red Hat Enterprise Linux is not affected as it does not ship dnf5daemon-server. Mitigations include removing or disabling dnf5daemon-server if not required or restricting D-Bus access to trusted users.
Apache APISIX versions 0.9 through 3.19.0 contain an interpretation conflict vulnerability that allows unauthenticated clients to access upstream paths protected by route-level authentication plugins if a route without authentication exists on the same upstream and the upstream does not collapse encoded dot segments. This incorrect authorization issue is fixed in version 3.20.0.
Apache APISIX versions from 3.19.0 up to but not including 3.20.0 contain a relative path traversal vulnerability combined with an unintended proxy behavior. This flaw allows a caller of the MCP endpoint to invoke endpoints not declared in the OpenAPI document, using the HTTP method declared for the tool and the credentials associated with the Route. The issue is resolved in version 3.20.0.
CVE-2026-124719 is an authentication bypass vulnerability in Apache APISIX versions from 3.19.0 up to but not including 3.20.0. The flaw occurs when a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, allowing an attacker to spoof another identity against the upstream API. The issue is fixed in version 3.20.0.
Apache APISIX versions 3.18.0 through 3.19.0 contain an authentication bypass vulnerability due to spoofing. This occurs on routes using jwe-decrypt with strict mode disabled and a forward_header different from the token header, allowing unauthenticated clients to supply values treated as decrypted plaintext by the upstream. A similar issue arises when forward-auth is configured with allow_degradation set to true and the authentication service is unavailable. The vulnerability is fixed in version 3.20.0.
Apache APISIX versions 3.18.0 through 3.19.0 contain an interpretation conflict vulnerability that leads to incorrect authorization. When the match_uri_encoded_slash option is enabled along with skip_mtls_uri_regex configuration, a client without a certificate can access upstream services behind routes that require client certificates, but only for request paths that decode to an exempted URI. This issue is resolved in version 3.20.0.
AiSOC versions from 12.1.0 up to but not including 23.3.0 have a missing authentication vulnerability. This flaw allows unauthenticated attackers to query the enrichment service via specific Next.js console rewrite routes, potentially retrieving threat intelligence data and consuming commercial API quota by setting a force parameter.
An incorrect authorization vulnerability exists in Apache APISIX versions 1.4.0 through 3.19.0. Authenticated users with any one of a route's required permissions or scopes can access the protected upstream, bypassing other required permissions and HTTP method restrictions. This issue is fixed in version 3.20.0.
A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to access sensitive .env configuration files and exfiltrate critical credentials. The vulnerability was mitigated around October 29, 2026, by implementing a sandbox component.
Apache APISIX versions 3.8.0 through 3.19.0 are affected by an authentication bypass vulnerability due to spoofing. This occurs when multi-authentication falls back from wolf-rbac to another authenticator, allowing client-supplied Wolf identity headers to persist and potentially mislead downstream services about the authenticated identity. The issue is fixed in version 3.20.0.
Catalis/Patriot Properties WebPro 5.0 contains a SQL injection vulnerability that allows remote unauthenticated attackers to execute arbitrary SQL queries on the underlying MSSQL database. This can lead to unauthorized access and exfiltration of sensitive property and taxpayer information. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Omnispace Agora Project versions through 26.10.0 have an open redirect vulnerability in the Ctrl.php redir() function. This flaw allows remote attackers to manipulate the objUrl parameter to redirect users to arbitrary external URLs. Such redirects can be exploited for phishing attacks and credential theft by tricking users into visiting malicious sites.
MRBS versions prior to 1.13.0 have a CSV formula injection vulnerability that allows authenticated users to inject malicious spreadsheet formulas. This occurs because the escape() function in web/report.php does not properly neutralize leading formula characters. Attackers can embed formulas in booking names, descriptions, or custom fields that execute when privileged users open exported CSV reports, potentially leading to data exfiltration or command execution via DDE.
Omnispace Agora Project versions through 26.10.0 have a vulnerability in token generation where the md5Id token can be predicted due to a missing dateCrea value. This allows unauthenticated attackers to compute valid tokens and access private calendar events by exploiting the misc&action=DisplayIcal endpoint without authentication.
Omnispace Agora Project versions through 26.10.0 have an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can exploit this flaw by manipulating the reloadMailTypeId parameter in the CtrlMail.php component to access private mail messages of other users without proper ownership checks. This leads to unauthorized disclosure of sensitive communication content.
An integer overflow vulnerability exists in picoquic versions before 2026.11.05.3e2e3d3 in the picoquic_decode_time_stamp_frame() function. This flaw allows remote QUIC peers negotiating the TIME_STAMP extension to send oversized TIME_STAMP values that cause integer overflow, corrupting stored timestamps. The corruption affects round-trip time (RTT) and bandwidth estimation, leading to degraded congestion control performance.
MRBS versions prior to 1.13.0 have a password reset poisoning vulnerability that allows unauthenticated attackers to forge the Host header when the $url_base configuration is unset. This enables attackers to cause password reset emails to contain links pointing to attacker-controlled hosts, potentially capturing reset keys and taking over user accounts, including administrators.