Lotus versions up to 0.10.2 have an authorization bypass vulnerability in the ChangeUserOrganizationView.post endpoint. Authenticated users can supply any organization's UUID to join that organization without proper authorization. This allows attackers who self-register and know another organization's UUID to access that organization's tenant data and billing configuration.
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
Lotus versions up to 0.10.2 have a SQL injection vulnerability that allows authenticated organization users to inject SQL commands via crafted billable metric property_name or categorical filter values. This injection occurs because these values are rendered unescaped into Jinja-generated metric queries, potentially exposing the shared database to unauthorized access.
Lotus versions up to 0.10.2 have an SQL injection vulnerability that allows authenticated organization users to execute arbitrary SQL commands by appending stacked statements to custom metric queries. This occurs because the application accepts semicolon-separated SQL statements via POST /app/metrics/ and bypasses validation that only checks the first statement. This vulnerability can lead to unauthorized reading or modification of data across all tenants.
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
JSON-SCADA versions before 0.65-alpha contain an SQL injection vulnerability in the opcApi() function within src/server_realtime_auth/index.js. This flaw allows authenticated users to inject SQL commands via HistoryReadRequest parameters, specifically through NodeId.Id, StartTime, or EndTime fields. Exploitation can lead to unauthorized reading, modification, or deletion of historian data across all locations regardless of user role.
CVE-2026-115327 is a medium severity vulnerability in CESNET libyang up to version 6.4.13. It involves an uninitialized pointer free in the function lydxml_env_netconf_rpc() when parsing NETCONF RPC action envelopes. An attacker with a NETCONF session can send crafted action elements containing non-whitespace text to cause server crashes or heap corruption in affected software such as netopeer2.
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
mem0 versions from 0.1.117 up to but not including 1.0.8 contain an SQL injection vulnerability in the file mem0/vector_stores/databricks.py. This vulnerability allows attackers to inject SQL commands by manipulating stored memory content such as memory text, metadata, or message names. The injection occurs due to unescaped string interpolation in insert() and update() operations targeting a Databricks SQL warehouse. The vulnerability has a critical severity with a CVSS 4.0 score of 9.2.
EverShop versions from 1.2.2 up to but not including 2.2.1 have a missing authorization vulnerability in the customer address API. This flaw allows unauthenticated attackers who know customer and address UUIDs to add, modify, or delete other customers' saved shipping addresses via POST, PATCH, or DELETE requests to the /api/customers/:customer_id/addresses endpoint.
fzf versions 0.36.0 through 0.74.5 have an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the --listen HTTP server by sending large POST requests, causing the single-threaded server to block for approximately 30 seconds per request. The vulnerability results from quadratic string concatenation, leading to resource exhaustion on the affected server.
Goploy versions 1.18.0 before 1.18.1 have a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints. Authenticated users with repository write access can exploit this to read arbitrary files outside the project directory by committing symbolic links. This may expose sensitive files such as database configuration and SSH private keys. The vulnerability has a high severity with a CVSS score of 7.1.
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.
Amazon Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerability in MadPot honeypot telemetry on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial exploit originated from a commercial anonymization network, indicating threat actor activity during the embargo period. Multiple proof-of-concept exploits appeared on the disclosure date with diverse payloads and infrastructure, suggesting involvement of multiple actors. After the embargo lifted on October 21, 2026, exploitation rapidly became widespread. This incident demonstrates that coordinated vulnerability disclosure does not guarantee zero-day protection and that AI-assisted exploit development has significantly reduced the time from patch release to active exploitation.
Parsedmarc versions from 8.11.0 up to but not including 9.9.0, and from 9.11.0 up to but not including 11.0.4, are affected by multiple cases where aiohttp can consume excessive or unbounded memory or CPU resources when processing attacker-controlled requests. This vulnerability allows an attacker to cause resource exhaustion, potentially impacting service availability.
Splunk and SolarWinds released security updates addressing multiple vulnerabilities that could allow attackers to execute code, escalate privileges, cause denial-of-service, and leak sensitive information. Splunk patched critical improper access control and data exposure issues in Splunk Enterprise and SOAR, while SolarWinds fixed a high-severity broken authorization flaw in Observability and medium-severity XSS, SSRF, and information disclosure bugs. These updates resolve dozens of security defects across product code and third-party libraries.