Juspay Hyperswitch versions before 1.128.0 have an authentication bypass vulnerability in the Worldpayxml connector. This flaw allows unauthenticated attackers to forge payment status updates by exploiting the verify_webhook_source function, which always returns true due to lack of enforced mTLS. Attackers who know the merchant_id and Worldpay orderCode can send unsigned XML with lastEvent set to SETTLED to the webhook endpoint, potentially marking unpaid payments as paid or triggering refund, dispute, and payout events.
Certain versions of CakePHP contain an email header injection vulnerability due to incomplete sanitization of header values in SmtpTransport and MailTransport. Attackers who can control custom email headers via Message::setHeaders() or Message::addHeaders() may inject bare carriage return (CR) or line feed (LF) characters, enabling injection of additional headers such as Bcc. This could allow redirection or alteration of outgoing emails.
CakePHP versions up to 5.4.3 have a header injection vulnerability in the FormDataPart component. This flaw allows attackers to inject MIME part headers by supplying unsanitized Content-Type and Content-ID values containing CR/LF sequences. The vulnerability affects attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data, enabling arbitrary header or content injection.
Juspay Hyperswitch versions through 1.128.0 and builds before 2026.10.19.0 have a missing authorization vulnerability. This flaw allows unauthenticated attackers, who possess the merchant's publishable key and a payout ID, to confirm payouts via a specific API endpoint. Attackers can overwrite payout details such as amount, currency, connector, and routing, enabling unauthorized merchant payouts.
CakePHP versions through 5.4.3 have an SQL injection vulnerability in the WindowExpression::range() and frame() methods. This flaw allows attackers to inject SQL by supplying unvalidated frame offsets and directions, which are used in the OVER clause of SQL queries. Exploitation could lead to execution of arbitrary SQL commands with the database connection's privileges.
CakePHP versions through 5.4.3 have a vulnerability in the Http Client CookieCollection component due to improper cookie domain validation. This flaw allows malicious servers to exploit unanchored suffix matching to receive and plant cookies improperly. Attackers controlling domains with suffixes matching the victim's domain or sending Set-Cookie headers with unrelated domain values can steal or inject cookies into client cookie jars.
CakePHP versions through 5.4.3 contain an SQL injection vulnerability that allows attackers to inject arbitrary SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. This vulnerability affects all database drivers used by the connection and can lead to full compromise of confidentiality, integrity, and availability of the database.
Bitwarden Server versions before 2026.10.1 using Entity Framework backends have an authorization bypass vulnerability. This flaw allows organization members to add ciphers to collections they are not authorized to edit. The vulnerability arises because a POST request to /api/ciphers/create with a nulled UserId is treated as administrative, enabling injection of vault items into read-only or inaccessible collections.
SQLite versions before 3.54.0 have an authorization bypass vulnerability in the lookupName() function. This flaw causes the authorizer callback to be invoked only for the first joined table's USING column, allowing attackers who can submit SQL queries to read columns that should be restricted by SQLITE_READ authorizer rules when using RIGHT or FULL JOINs on shared USING columns.
OPNsense versions before 26.7.8 have a command injection vulnerability that allows authenticated users with System: Firmware privileges to execute arbitrary commands as root. This is achieved by submitting a malicious firmware mirror URL via the API endpoint /api/core/firmware/set, which is evaluated unsafely. The vulnerability also enables attackers to disable package signature verification through sed injection.
SQLite versions prior to 3.54.0 contain a use-after-free vulnerability in the R-Tree extension. This flaw allows attackers to cause applications to use freed heap memory by manipulating the %_node shadow table. Specifically, supplying a database that declares %_node WITHOUT ROWID or includes a RAISE(IGNORE) trigger causes nodeWrite() to hash nodes as zero, leading to a crash after node splits.
Element Web and Element Desktop versions before 1.12.32 have a vulnerability where guest credentials passed via URL fragment parameters in the loadSession function can be accepted. This allows remote unauthenticated attackers to log out users and clear local storage, potentially destroying unbacked end-to-end encryption keys by forcing an attacker-controlled guest session.
SQLite versions before 3.54.0 that are built with the session extension have a heap buffer overflow vulnerability in the sqlite3changeset_apply() function. This flaw allows attackers to corrupt heap memory by providing specially crafted changesets that exploit improper memory handling when a table name is repeated with a larger column count in a second changeset block.
A remote code execution vulnerability exists in n8n versions before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1. This flaw involves deprecated Function, Function Item, and LangChain Code nodes that run outside the task runner isolation, allowing authenticated users with workflow creation or modification privileges to execute arbitrary JavaScript code in the main n8n process.
SQLite versions prior to 3.54.0 have a stack exhaustion vulnerability that enables attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining a large number of COLLATE postfix operators. This can cause unbounded recursion in the sqlite3WalkExprNN() function, leading to a process crash.
Płatnik has a vulnerability where it performs client-side authentication, allowing an attacker with access to any connected application instance to bypass login verification and authenticate as any user. This security flaw was fixed in version 10.02.002 (metric 242).
Płatnik software used a weak password encoding algorithm that allowed users who obtained encoded passwords to easily decode them. This vulnerability was fixed in version 10.02.002 (metric 242). The issue has a high severity rating with a CVSS score of 7.7.
ProFTPD versions before 1.3.9e and 1.3.10rc5 have a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap. This flaw allows remote attackers to send FTP command arguments longer than 1024 bytes, potentially overwriting static buffers and corrupting session memory, which can crash the session. The vulnerability can be exploited without authentication if pre-login commands are rewritten.
SQLite versions before 3.54.0 have a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit. This occurs because common table expressions (CTEs) are not counted against this limit. An attacker can supply a WITH clause chaining tens of thousands of CTEs, either via plain SQL or a view in an untrusted database file, causing unbounded recursion in selectExpander() that crashes the process.
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.