A vulnerability in Sonatype Nexus Repository 3 allows a user with edit permissions on a hosted OCI repository to inject script content into the artifact type field of an OCI manifest. This script executes in the browser of any user who views the Attestations tab for the related image in the Browse UI, running with the permissions of the viewing user. This cross-site scripting (XSS) vulnerability can lead to unauthorized script execution in the context of the Nexus Repository web interface.
DeepSeek Harness versions prior to 0.1.2-alpha.2, specifically commit 3e24087, have a missing authentication vulnerability in the web profile HTTP and WebSocket RPC control plane. This flaw allows any local process, including those running under different OS users, to access unauthenticated session methods such as session.create and session.prompt. Exploitation enables attackers to execute arbitrary commands as the victim user, intercept live session traffic and logs, and bypass human tool-approval checks.
A cross-site scripting (XSS) vulnerability exists in InfiniFlow RAGFlow up to version 0.27.2 in the Images API component, specifically in the file api/utils/file_utils.py. The vulnerability can be exploited remotely and allows an attacker to execute malicious scripts. A public exploit is available. Upgrading to version 0.27.3 addresses this issue.
Yealink Plug-in Softwares prior to version 2.35.219.0 contain an unauthorized file write vulnerability that can be exploited under certain conditions to achieve remote code execution. This vulnerability is critical and has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability.
A critical OS command injection vulnerability exists in Linksys E5350 version 1.0.00.037 in the /wizard/apply.cgi file. The flaw arises from manipulation of the ping_ip or traceroute_ip arguments, allowing remote attackers to execute arbitrary OS commands. Public exploit code is available, but the vendor has not responded or provided a fix.
Yealink MeetingBoard Pro versions before 331.320.0.64 contain a front-end validation bypass vulnerability in the Web management module. An attacker with administrator privileges on the local network can manipulate the page DOM to bypass UI control logic and invoke screenshot functions that are normally restricted. Exploitation requires a valid administrator account and local network access.
Yealink UVC40 E2 devices running firmware versions before 319.410.0.71 are vulnerable to an attack by an adversary with short-term physical access. The attacker can extract Wi-Fi credentials through the USB interface and abuse sensitive firmware configuration data to gain root privileges. This enables audio and video eavesdropping within Wi-Fi coverage without triggering any LED alerts on the device.
A critical OS command injection vulnerability exists in the Ping Diagnostic component of Linksys WRT54GL version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the ping_ip argument allows remote attackers to execute arbitrary OS commands. The vulnerability is publicly known with available exploit code. However, the affected product is no longer supported by the vendor, and no patch or official response has been provided.
A cross-site scripting (XSS) vulnerability exists in EmpireSoft EmpireCMS up to version 8.0 in the /e/member/mspace/index.php file. The flaw is triggered by manipulation of the spacename argument and can be exploited remotely. Public exploit code is available, but the vendor has not responded or issued a fix. The CVSS score is 3.5, indicating low severity.
A critical remote command injection vulnerability exists in the Traceroute Diagnostic Function of Linksys WRT54GL firmware version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the traceroute_ip argument allows an attacker with high privileges to execute arbitrary OS commands. This vulnerability affects an unsupported product, and no vendor response or patch is available. Public exploit code has been disclosed.
Invoice Ninja versions before 5.13.28 have a broken access control vulnerability that allows authenticated vendor-portal users to access documents of other vendors and clients. This occurs because authorization checks validate only company_id scope instead of verifying vendor ownership. Attackers can exploit predictable sequential Hashids document identifiers due to a default empty HASH_SALT to download invoice PDFs, contracts, payment receipts, and expense attachments belonging to other vendors within the same company.
Node Version Manager (nvm) versions 0.40.0 through 0.40.8 contain a vulnerability where the commands 'nvm use --save' and 'nvm install --save' write the resolved Node.js version string to a .nvmrc file in the current directory using 'tee', which follows symbolic links. If the .nvmrc file is a symlink to a file outside the repository, this can cause unintended truncation and overwriting of arbitrary writable files, such as shell startup files or SSH authorized_keys, resulting in data loss. Version 0.41.0 fixes this by refusing to write to .nvmrc if it is a symlink, issuing a warning instead.
Alan: Health Insurance for Android version 1.450.0 contains a path traversal vulnerability in its exported ShareReceiverActivity. This flaw allows a malicious app on the same device to write files outside the intended directory by exploiting an unsanitized _display_name parameter. Attackers can overwrite sensitive files within the app's sandbox, such as databases and WebView data, potentially enabling state tampering or code execution without user interaction or authentication.
Node Version Manager (nvm) versions 0.5.0 through 0.40.8 contain an argument injection vulnerability (CWE-88) where version patterns from a .nvmrc file starting with '-' are interpreted as grep options. This causes unintended recursive directory searches, potentially leaking sensitive data such as npm tokens from symlinked files to terminal output and logs. The issue is fixed in version 0.41.0 by passing version patterns to grep with the '-e' option.
Node Version Manager (nvm) versions 0.2.0 through 0.40.8 do not properly check if the .nvmrc file is a symbolic link. This allows an attacker to craft a symlinked .nvmrc pointing to arbitrary files, causing nvm commands to read and print the contents of those files in command output or logs. Version 0.41.0 fixes this by not printing the contents of symlinked .nvmrc files and only accepting valid version strings or aliases.
CVE-2026-122016 is a medium severity vulnerability in yangzongzhuan RuoYi-Vue versions 3.9.0, 3.9.1, and 3.9.2. It involves improper privilege management in the SysPermissionService.getMenuPermission function, allowing remote attackers to manipulate permissions arguments. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
Node Version Manager (nvm) versions 0.27.0 through 0.40.8 contain a vulnerability where the 'nvm use --delete-prefix' command can cause npm to rewrite arbitrary configuration files chosen by a project's .npmrc file. This can corrupt files such as ~/.bashrc or leave configuration files with insecure permissions, potentially allowing local users on shared machines to modify them. The vulnerability is fixed in version 0.41.0, which prevents a project .npmrc from selecting which config file is edited.
Node Version Manager (nvm) versions 0.40.5 through 0.40.8 have a vulnerability where a downloaded release archive is cached before checksum verification. If the checksum fails, the corrupted archive remains in the cache and can be installed later using 'nvm install --offline' without re-verifying the checksum, allowing execution of potentially malicious code. This issue is fixed in version 0.41.0, which only caches archives after successful checksum verification.
Node Version Manager (nvm) versions 0.40.0 through 0.40.8 have a vulnerability where the authorization header set in NVM_AUTH_HEADER is passed as a visible command-line argument to curl or wget during downloads. This exposure allows other local users on the same machine to potentially read sensitive tokens via process listings. The issue is fixed in version 0.41.0, which changes the method of passing the header to avoid command-line exposure.
Node Version Manager (nvm) versions 0.39.6 through 0.40.8 contain an OS command injection vulnerability in the handling of remote LTS aliases. The vulnerability arises because the version column from the mirror's index.tab file is stored without validation and later evaluated in shell arithmetic, allowing command substitution execution under bash and zsh. Exploitation requires use of a hostile mirror or man-in-the-middle attack and running affected nvm commands. The issue is fixed in version 0.41.0 by restricting arithmetic evaluation to numeric offsets and dropping invalid version strings.