Critical severity threats

CVE-2026-61730 is a critical vulnerability in socfortress CoPilot versions prior to 0.1.77. It allows unauthenticated access to the /scoutsuite-report static files directory, exposing sensitive cloud security reports and potentially private Google service-account JSON keys during scans. This exposure can lead to unauthorized access to AWS, Azure, and GCP IAM principals and resource inventories. The issue is fixed in version 0.1.77.

CVE-2026-61729 is a critical vulnerability in socfortress CoPilot versions prior to 0.1.76. It involves missing authentication for critical webhook functionality due to a publicly hardcoded fallback header secret. This allows an anonymous attacker to bypass JWT authentication and invoke active-response commands on the Wazuh manager, potentially disrupting endpoints and manipulating defensive controls. The flaw also permits forged alerts to drive attacker-controlled OpenSearch queries. The issue is fixed in version 0.1.76.

CVE-2026-61728 is a critical cross-site scripting (XSS) vulnerability in socfortress CoPilot versions prior to 0.1.76. It allows authenticated portal users to submit stored markup that is rendered without proper sanitization, leading to persistent script execution when viewed by other users. This can result in theft of authentication tokens and enable persistent privileged account takeover, cross-tenant data access, and manipulation of incidents. The vulnerability affects multiple components rendering user input unsafely. Fixes were introduced in versions 0.1.70 and fully contained in 0.1.76.

Vvveb, a CMS with a page builder, has an improper authorization vulnerability (CWE-285) in versions prior to 1.0.8.7. This flaw allows an authenticated administrator to read and overwrite API tokens of other administrators via the admin/auth-token endpoint. The vulnerability is patched in version 1.0.8.7.

Vvveb CMS versions prior to 1.0.8.7 contain an authentication bypass vulnerability in the password reset functionality. This flaw arises from insufficient validation of user and token parameters in GET requests, allowing attackers to bypass authentication controls. The issue has been fixed in version 1.0.8.7.

MuseBot versions prior to 2.0.0 have an authentication bypass vulnerability due to a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing session cookies with the default key, granting full administrative access to sensitive data and control over the bot. The issue is fixed in version 2.0.0.

OpenDeepWiki versions up to 2.0.6 contain a vulnerability where a hard-coded JWT signing key is exposed in the appsettings.json file. This allows unauthenticated attackers to forge administrator tokens by using the known Jwt:SecretKey. Exploiting this, attackers can create HS256 bearer tokens with admin privileges to access sensitive /api/admin endpoints, enabling control over users, roles, repositories, settings, and API keys.

CallBackery versions prior to 0.62.0 for Perl have a log injection vulnerability (CWE-117) due to improper neutralization of control characters in login names. The unauthenticated login RPC method allows attackers to inject forged log entries by including newline characters in login names, potentially creating misleading log records such as fake successful administrator logins from arbitrary IP addresses. This vulnerability is fixed in version 0.62.0.

CallBackery versions before 0.62.0 for Perl have a permissive regular expression vulnerability in the createRxValidator function. This flaw allows authenticated users to bypass intended validation by submitting values that should be rejected, potentially leading to unsafe data being written into generated configuration files. The issue is fixed in version 0.62.0.

Starlet versions before 0.33 for Perl improperly send a body in responses to HEAD requests, leading to corruption of subsequent responses on persistent or pipelined HTTP connections. This can cause desynchronization in proxies that share connections across clients. The issue is fixed in version 0.33.

CVE-2026-116130 is a vulnerability in HTTP::Parser::XS versions before 0.18 for Perl where the PATH_INFO is truncated at an encoded null byte (%00) during HTTP request parsing. This occurs because the XS parser URL-decodes the request path and uses strlen() to measure it, causing the path to end prematurely at the first decoded null byte. The pure-Perl backend is not affected. This discrepancy can allow a remote attacker to send a path that is fully checked by a proxy or filter but routed differently by the application.

vsftpd versions up to 3.0.5 have an authentication bypass vulnerability in the ssl_data_accept() function. This flaw allows unauthenticated attackers who share the victim's source IP to hijack FTPS data connections by resuming their own TLS session ticket. Exploitation enables attackers to steal downloads or inject upload data by connecting to the victim's PASV port. The vulnerability is fixed in version 3.0.6.

CVE-2026-119419 is a critical SQL injection vulnerability in CakePHP versions up to 5.4.3. It arises from improper neutralization of special elements in SQL commands when unvalidated collation values are supplied to StringExpression and IdentifierExpression. Attackers who control the collation name can append arbitrary SQL after the unquoted COLLATE clause, potentially affecting all database drivers accessible with the connection's privileges.

CVE-2026-119418 is a critical SQL injection vulnerability in CakePHP versions up to 5.4.3. It arises from improper neutralization of special elements in SQL commands, specifically when unvalidated frame offsets and directions are supplied to WindowExpression::range() and frame() methods. This allows attackers to inject malicious SQL code via user input forwarded into the OVER clause, potentially executing commands with the database connection's privileges.

CVE-2026-116366 is a critical integer overflow or wraparound vulnerability in ClickHouse Server that allows an unauthenticated network attacker to execute arbitrary code. Multiple versions of ClickHouse prior to fixed releases are affected. The vulnerability has a high CVSS 4.0 score of 9.5, indicating severe impact if exploited. Fixed versions are available, and no known exploits are currently reported in the wild.

CVE-2025-31704 is a critical OS command injection vulnerability in Dahua Intelligent Connection Center. A remote attacker can send specially crafted requests to execute arbitrary commands on the affected system, leading to remote code execution. The flaw affects versions from 1.000.0000000.1 through 1.000.0000005.0 and from 5.000.0000000.6 up to but not including 5.000.0000000.15. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. A fix is available in version 5.000.0000000.15.

A SQL Injection vulnerability exists in Apache Fineract through version 1.15.0. It affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint due to improper neutralization of special elements in SQL commands. This allows attackers to inject malicious SQL code. The issue is fixed in version 1.16.1.