Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
CVE-2026-119547 is an information disclosure vulnerability in Forgejo affecting versions up to 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1. The flaw exists in the GetPublicKey API handler, which does not properly check ownership when looking up keys. Authenticated users with read:user tokens or sessions can enumerate sequential key IDs to access titles, fingerprints, and public key material of other users' SSH, deploy, and principal keys.
Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contain a path traversal vulnerability in the restore-repo functionality. This flaw allows attackers to read files outside the intended dump directory by supplying crafted asset paths with '../' sequences. Specifically, attackers can manipulate the release.yml file's DownloadURL or PatchURL to import arbitrary files, such as app.ini, as release attachments during repository restoration by an administrator.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
CVE-2026-119428 is a server-side request forgery (SSRF) vulnerability in phpMyAdmin versions up to 5.2.3. It allows unauthenticated attackers to send crafted POST requests to setup/validate.php, which lacks proper access restrictions. This can lead to outbound MySQL-protocol connections to attacker-specified hosts and ports, enabling internal port probing via error messages.
phpMyAdmin versions up to 5.2.3 contain an SQL injection vulnerability in the Designer saveSetting() function. Authenticated users can exploit this flaw by sending crafted parameters to the /database/designer endpoint, potentially overwriting other users' designer settings or executing controluser subqueries. The vulnerability arises from improper neutralization of special elements in SQL commands via unescaped json_encode() output.
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
OPNsense core versions before 26.7.8 have a configuration line injection vulnerability that allows authenticated users with wireless-edit privileges to inject arbitrary directives by embedding CR/LF characters in WPA-related fields. This vulnerability enables attackers to append unauthorized wpa_supplicant or hostapd directives, potentially impacting the wireless configuration.
OPNsense core versions before 26.7.8 have a log injection vulnerability that allows unauthenticated attackers to submit crafted WebGUI login usernames containing victim IP addresses. This can cause the victim IP to be added to the sshlockout table, blocking SSH and WebGUI access and terminating pf states. The vulnerability is fixed in version 26.7.8.
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Lago versions up to 1.55.0 have an authentication bypass vulnerability in the acceptInvite mutation. This flaw allows organization administrators to obtain session tokens for existing accounts without password verification. Exploitation enables attackers to access sensitive organizational data including billing, API keys, and payment integrations by inviting a victim's email and accepting with any password.
CVE-2026-119419 is a critical SQL injection vulnerability in CakePHP versions up to 5.4.3. It arises from improper neutralization of special elements in SQL commands, specifically through unvalidated collation values supplied to StringExpression and IdentifierExpression. Attackers can inject arbitrary SQL by manipulating the collation name, potentially affecting all database drivers accessible by the connection.
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
CVE-2026-119416 is a vulnerability in CakePHP up to version 5.4.3 involving improper cookie domain validation in the Http Client CookieCollection. This flaw allows malicious servers to exploit unanchored suffix matching to receive and plant cookies improperly. Attackers controlling domains with suffixes matching victim domains or sending Set-Cookie Domain values for unrelated hosts can steal or inject cookies into client cookie jars.
CVE-2026-119415 is a header injection vulnerability in CakePHP versions up to 5.4.3. It allows attackers to inject MIME part headers by supplying CR/LF sequences in Content-Type and Content-ID values used in attachments or multipart HTTP client data. This can lead to arbitrary headers or content being added to MIME parts.