Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
n8n versions prior to 2.42.6, 2.43.3, and 3.0.1 contain a remote code execution vulnerability due to improper isolation of certain deprecated nodes. Authenticated users able to create or modify workflows with these nodes can execute JavaScript in the main n8n process, leading to high-severity impact.
Element Web and Element Desktop versions before 1.12.32 have a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows remote unauthenticated attackers to log out users and clear local storage by exploiting guest credentials passed via URL fragment parameters. Attackers can trick logged-in users into opening specially crafted links that force an attacker-controlled guest session, resulting in the destruction of unbacked end-to-end encryption keys.
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
SQLite versions prior to 3.54.0 contain an authorization bypass vulnerability in the lookupName() function. This flaw causes the authorizer callback to be invoked only for the first joined table's USING column, allowing attackers who can submit SQL to bypass SQLITE_READ restrictions on shared USING columns in RIGHT or FULL JOIN queries.
SQLite versions prior to 3.54.0 contain a stack exhaustion vulnerability due to uncontrolled recursion triggered by chaining COLLATE postfix operators. This allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by supplying approximately 175,000 chained COLLATE operators in SQL statements or untrusted database views, causing unbounded recursion in the sqlite3WalkExprNN() function and crashing the process.
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
CVE-2026-119373 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0 when built with FTS5 enabled. The flaw occurs in the fts5MergeRowidLists() function, which undersizes the output buffer during merging of detail=none prefix doclists. An attacker able to insert negative rowids into a detail=none FTS5 table and execute a prefix MATCH query can trigger out-of-bounds writes, leading to heap corruption and process crashes.
CVE-2026-119372 is a use-after-free vulnerability in SQLite versions prior to 3.54.0 when built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS enabled. The flaw exists in the fts3BestSnippet() function due to dangling cached position-list pointers. An attacker can exploit this by running a full-text MATCH query combining OR and NEAR operators with snippet(), potentially causing the process to read freed heap memory and crash.
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
CVE-2026-119147 is an authorization bypass vulnerability in ProFTPD versions before 1.3.9e and 1.3.10rc5. It affects the mod_sftp copy-file extension handler, allowing authenticated SFTP users to copy readable files to new locations in directories where write permissions are denied. This bypasses the intended Limit WRITE restrictions, enabling unauthorized file creation in protected directories.
ProFTPD versions before 1.3.9e and between 1.3.10rc1 and before 1.3.10rc5 contain a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap. This flaw allows remote attackers to send FTP command arguments longer than 1024 bytes, potentially overwriting static buffers and corrupting session memory, which can lead to session crashes. The vulnerability can be exploited without authentication if pre-login commands are rewritten.
A highly critical access bypass vulnerability (CVE-2026-118539) in the Drupal Commerce Core module is actively exploited in the wild. This flaw allows unauthenticated attackers to bypass access controls on certain routes and entity fields, potentially leading to financial impact for online store vendors. The vulnerability affects Commerce Core 3.x versions prior to 3.3.13 and earlier 8.x-2.x releases before 8.x-2.41. Drupal urges administrators to update to fixed versions and audit their store orders for inconsistencies. The module is widely used on over 42,000 sites. Drupal assigned a high risk score of 21 out of 25 to this vulnerability. No detailed exploitation methods or attacker identities have been disclosed.
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.