OpenPanel versions prior to 3.0.0 have an information disclosure vulnerability that allows users with read-level access to a project to retrieve argon2id hashes of ingestion credentials. This occurs via the client.list tRPC query, which returns full Client rows including the secret column. This exposure enables offline verification of leaked secrets without generating audit trails.
OpenPanel versions prior to 3.0.0 have an SQL injection vulnerability in the ConversionService.getConversion function. This flaw allows project-read members and share-link holders to inject arbitrary ClickHouse SQL via unescaped event names and dates. Exploitation can bypass project_id scoping by injecting conditions like OR 1=1, enabling unauthorized access to other tenants' analytics data.
OpenPanel versions before 3.0.0 have an SQL injection vulnerability that allows authenticated users to bypass tenant scoping. This occurs because unescaped profile filter names are injected into a JOIN subquery, enabling attackers to manipulate the query and read events from all projects. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.
OpenPanel versions before 3.0.0 have an information exposure vulnerability where sensitive data such as database connection URLs and email template information are written to standard output logs. This includes database credentials in migration startup logs and password-reset tokens when certain environment variables are unset. Unauthorized users with access to these logs can obtain this sensitive information.
A cross-site scripting (XSS) vulnerability exists in Argilla up to version 2.8.0 in an unknown function within the Sandbox.vue component. The vulnerability arises from improper handling of the 'template' argument, allowing remote attackers to execute script code. The issue has been publicly disclosed, but no official response or patch has been provided by the project at this time. The vulnerability has a low CVSS score of 2.4 and requires high privileges and user interaction for exploitation.
WWBN AVideo versions prior to 29.5.0 have a local file inclusion (LFI) vulnerability. This flaw allows unauthenticated attackers to include and execute PHP files outside the intended locale directory by exploiting crafted Accept-Language headers. The vulnerability arises due to insufficient sanitization of traversal sequences like ....// in the setLanguage() function, enabling bypass of single-pass removal mechanisms.
A command injection vulnerability exists in apache-airflow-providers-ssh versions before 7.0.1 in the SSHRemoteJobOperator. The operator incorrectly quotes environment parameter values only once, allowing shell syntax like $(...) to be executed on the remote SSH host. This enables a user who can trigger a DAG but cannot author DAGs to execute arbitrary commands on the remote host as the SSH user. Upgrading to version 7.0.1 or later mitigates this issue.
SourceCodester Online Food Ordering System 1.0 contains a path traversal vulnerability in the unlink function of admin/delete.php. This flaw allows remote attackers to manipulate the image_name argument to delete arbitrary files. Public exploit code is available, and the vulnerability has a medium severity rating with a CVSS score of 6.5.
Parse Server versions before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 contain a vulnerability where the owning object reference in $relatedTo relation queries is not properly validated. This allows a client with read access to at least one object of the owning class to bypass owning-object ACL checks by supplying a query operator instead of an object ID, potentially disclosing which readable objects are linked to owning objects it cannot read.
DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to bypass the SMIL attributeName=href guard when parsing application/xhtml+xml content because attribute names are not properly lowercased. An attacker can craft SVG content with animate or set elements using attributeName="href" and a javascript: URI to execute scripts when users click the sanitized link.
CVE-2026-76654 is an NTLM coercion vulnerability affecting Windows nodes in Kubernetes environments. It occurs when a pod's volumeMount subPath is set to a symbolic link pointing to an attacker-controlled network share. The kubelet resolves the symlink and attempts NTLM authentication to the share, exposing the NetNTLMv2 hash of the kubelet's running account. This hash could be cracked or relayed to impersonate the node if it is domain-joined.
A vulnerability in SourceCodester Online Food Ordering System 1.0 allows remote attackers to bypass authentication by manipulating the ID argument in the admin/delete_admin.php file. This issue can lead to unauthorized actions without requiring user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.5. Public exploit code has been disclosed, but there are no known exploits in the wild. No patch or remediation information is currently available.
DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to retain event handlers in detached DOM subtrees that are not sanitized, enabling malicious event handlers like img onerror to execute after the sanitize() function completes. The vulnerability arises when an IN_PLACE hook removes a parent or sibling node, leaving attacker-controlled markup unneutralized.
A cross-site scripting (XSS) vulnerability exists in Argilla up to version 2.8.0 in a text field component. The vulnerability arises from improper handling of the 'text' argument in the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The flaw can be exploited remotely but requires user interaction and high privileges. The project has been notified but has not yet responded or issued a fix. Public exploit code is available.
CVE-2026-2270 is a medium severity vulnerability in the StatefulSet controller that enables a confused deputy attack. A user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects can create a pod in a different namespace. The attacker gains full control over the pod's metadata and specification, including the namespace. However, the cross-namespace pod is deleted by the garbage collector unless the attacker can reference a valid StatefulSet OwnerReference in the victim namespace.
SourceCodester Online Food Ordering System 1.0 contains a vulnerability in the admin/add_food.php file where manipulation of the image argument allows unrestricted file upload. This flaw can be exploited remotely and has publicly available exploit code. The vulnerability has a medium severity rating with a CVSS score of 4.7.
flatcc versions through 0.6.4 have an integer overflow vulnerability in the check_header function of the FlatBuffers verifier. The overflow guard code is ineffective, allowing crafted buffer offsets on 32-bit builds to bypass bounds checks. This can cause an out-of-bounds read before the buffer and lead to process crashes.
QloApps versions 1.6.0 through 1.7.0 have a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action. This flaw allows unauthenticated attackers to submit reviews for arbitrary orders by reusing a publicly exposed review_ajax_token and enumerating sequential order IDs. The vulnerability enables attackers to post fake ratings and reviews attributed to other customers without authentication.
Transmission versions 4.0.0 up to but not including 4.1.3 have a permissive CORS vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read the token from the 409 handshake response and reuse it to perform unauthorized RPC calls. These calls can lead to actions such as executing script-torrent-done, changing the download directory, or deleting torrents and data.
ntop nDPI versions through 6.0 have an out-of-bounds read vulnerability in the dissect_softether_host_fqdn() function within softether.c. This flaw arises because the function compares host_name using the consumed byte count rather than the actual data length. An attacker can exploit this by sending crafted short UDP datagrams on already-classified SoftEther flows, causing the strncmp function to read beyond the packet payload buffer, potentially leading to a denial of service.