Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.
The npm package 'lineparse' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The ansi-sanitize npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software or control established by the attacker.
CVE-2026-123965 is a prompt injection vulnerability affecting the Jet Admin cloud platform. The issue was mitigated around October 29, 2026, by implementing a sandbox component. No specific affected versions are identified, and no public exploit or CVSS score is available.
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.
The OpenTelemetry Python API's TraceContextTextMapPropagator.extract() method is vulnerable to a regular expression denial of service (ReDoS) attack when processing specially crafted traceparent values. Malicious input containing a trace-context prefix followed by a long whitespace sequence and embedded newlines can cause quadratic-time regex backtracking, leading to excessive CPU consumption and request delays. This vulnerability affects versions prior to 1.45.2. The issue does not allow data disclosure, modification, or code execution but can degrade service availability. The vulnerability is mitigated by upgrading to version 1.45.2 or later, which rejects overly long traceparent values and removes problematic regex patterns.
Soup Sieve versions prior to 3.0.2 contain a regular expression vulnerability in the IDENTIFIER/CSS_ESCAPES regex used during selector compilation. This flaw causes exponential backtracking on a sequence of ambiguous digit-escapes (\9) in CSS selectors, leading to denial of service by hanging the process at compile time. The issue affects the public soupsieve.compile() function and BeautifulSoup's .select() method when processing untrusted selector strings. The vulnerability is fixed in version 3.0.2 and later.
Soup Sieve's CSS selector parser has an uncontrolled recursion vulnerability when parsing nested pseudo-class selectors such as :is(), :not(), :where(), and :has(). An attacker supplying a deeply nested selector string (about 330 levels) can cause a RecursionError by exceeding Python's recursion limit. This leads to a denial of service for the individual request or task parsing the selector. The issue affects versions from 0.4 up to but not including 3.0.2, with a fix available in 3.0.2. No confidentiality or integrity impact is present, and the failure occurs before document matching.
CVE-2026-124041 is a SQL injection vulnerability affecting Catalis WebPro version 5.0. The vendor recommends using the most recently available version of WebPro to address this issue. No specific patch or fixed version is provided in the available data.
The npm package '@claudecode/cli' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
This entry concerns vulnerabilities identified in the Social Security Administration's dce-web component, referenced by CVE-2026-104371. The vulnerabilities include issues related to improper access control (CWE-353), missing or ineffective security mechanisms (CWE-1104), and information exposure (CWE-200). The vulnerabilities were first scanned in July 2026 and re-validated in September 2026. No specific affected versions or CVSS score are provided, and there is no indication of active exploitation or available patches.
CVE-2026-128986 is an incorrect authorization vulnerability in Eclipse BaSyx Go Components up to version 1.1.3. The issue arises because ABAC-enabled deployments match access rules against the fully decoded request path, while the router uses the raw encoded path. This mismatch allows an authenticated user with read access to parts of a resource to read the entire resource if the resource identifier contains encoded slashes (%2F). The vulnerability is fixed in version 1.1.4.
C-Kermit versions from 7.0.197 up to but not including 11.1.515 contain an authentication bypass vulnerability in the IKSD SSL build. This flaw allows attackers with a trusted certificate mapped to a refused account to bypass authentication and gain shell access to any other account by exploiting the Telnet authentication state remaining at AUTH_VALID after a refused certificate login. The vulnerability is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 have a vulnerability in SSL certificate validation that allows attackers to impersonate Telnet servers. This occurs because the ssl_reply() function does not verify the server's hostname against the certificate, enabling man-in-the-middle attacks. Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data. The issue is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a vulnerability in certificate hostname validation. This flaw allows attackers with a trusted certificate containing wildcard characters to impersonate hosts by exploiting improper matching logic in the dNSName_cmp() function. Successful exploitation could lead to interception of credentials and data over TLS connections used by Telnet, FTP, and HTTP protocols. The vulnerability is rated high severity with a CVSS 4.0 score of 7.6. A fix is available in version 11.1.515.
C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.
C-Kermit versions 11.0.506 up to but not including 11.1.515 contain a vulnerability in the RECEIVE CONFIRM feature that allows malicious Kermit servers to write files without user confirmation. This occurs due to improper authorization checks in recursive GET root computation, enabling attackers to write sensitive files like .ssh/authorized_keys or shell startup files silently. This can lead to persistent unauthorized access or code execution. The issue is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a path traversal vulnerability in the doftpget() function. This flaw allows malicious FTP servers to write files outside the intended directory by returning crafted paths during recursive FTP get operations. Exploitation can lead to overwriting critical files such as .bashrc, potentially enabling code execution.