OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows logged-in customers to bypass payment by manipulating reward points during checkout. Attackers can select Free Checkout, apply reward points, then clear them before finalizing the order, causing the system to advance the order without payment.
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
CVE-2026-119555 is an information disclosure vulnerability in Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0. The flaw exists in the core_grades_get_feedback web service, which does not enforce group-membership and enrolment checks. This allows non-editing teachers to iterate user IDs and access grade feedback and personal identity fields such as email addresses of users outside their authorized groups.
CVE-2026-119554 is an SQL injection vulnerability in Moodle's External database enrolment plugin affecting multiple versions including 5.3.0 and earlier releases down to 4.5.15. The flaw allows editing teachers to inject malicious SQL payloads via the course idnumber field, which executes during scheduled synchronization with MySQL/MariaDB external databases. This can lead to unauthorized reading of data and manipulation of enrolment results.
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Jellyfin versions up to 12.4 have an authorization bypass vulnerability in the SuggestionsController.GetSuggestions endpoint. Authenticated non-administrator users can omit the userId parameter in requests to bypass library and parental restrictions. This allows attackers to enumerate restricted media items, including their IDs and server filesystem paths, and stream them without proper authorization.
CVE-2026-119550 is an information disclosure vulnerability in Jellyfin versions up to 12.4. It allows authenticated users, including restricted or parental-controlled accounts, to access hidden item IDs from public or shared playlists. This can lead to unauthorized streaming of media that should be inaccessible.
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
CVE-2026-119547 is an information disclosure vulnerability in Forgejo affecting versions up to 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1. The flaw exists in the GetPublicKey API handler, which does not properly check ownership when looking up keys. Authenticated users with read:user tokens or sessions can enumerate sequential key IDs to access titles, fingerprints, and public key material of other users' SSH, deploy, and principal keys.
Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contain a path traversal vulnerability in the restore-repo functionality. This flaw allows attackers to read files outside the intended dump directory by supplying crafted asset paths with '../' sequences. Specifically, attackers can manipulate the release.yml file's DownloadURL or PatchURL to import arbitrary files, such as app.ini, as release attachments during repository restoration by an administrator.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
CVE-2026-119428 is a server-side request forgery (SSRF) vulnerability in phpMyAdmin versions up to 5.2.3. It allows unauthenticated attackers to send crafted POST requests to setup/validate.php, which lacks proper access restrictions. This can lead to outbound MySQL-protocol connections to attacker-specified hosts and ports, enabling internal port probing via error messages.
phpMyAdmin versions up to 5.2.3 contain an SQL injection vulnerability in the Designer saveSetting() function. Authenticated users can exploit this flaw by sending crafted parameters to the /database/designer endpoint, potentially overwriting other users' designer settings or executing controluser subqueries. The vulnerability arises from improper neutralization of special elements in SQL commands via unescaped json_encode() output.
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
OPNsense core versions before 26.7.8 have a configuration line injection vulnerability that allows authenticated users with wireless-edit privileges to inject arbitrary directives by embedding CR/LF characters in WPA-related fields. This vulnerability enables attackers to append unauthorized wpa_supplicant or hostapd directives, potentially impacting the wireless configuration.