Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the CookieController.ListCookies function. This flaw arises from improper handling of the 'guid' argument, allowing remote attackers to access sensitive information. The vendor has not responded to disclosure attempts, and no patch or fix is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-59106 is a critical OS command injection vulnerability in the WolfProt interface of WolfVision Cynap Pure (Next Gen) and Cynap Bridge devices. An unauthenticated attacker with network access can exploit insufficient input neutralization to execute arbitrary operating system commands with the privileges of the affected application service. The vulnerability affects versions prior to 2.00c for Cynap Pure (Next Gen) and prior to 1.78a and 1.72e for Cynap Bridge. Fixed versions are available.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap-based buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values, allowing a malicious USB device to supply crafted descriptors that overflow the fixed-size epList array. This can lead to heap memory corruption, potentially enabling code execution or denial of service.
NXP MCUXpresso SDK USB middleware versions prior to 2.13.0 contain an out-of-bounds read vulnerability in the USB_DeviceCdcRndisSetCommand() function. This flaw arises from trusting a host-supplied informationBufferOffset, allowing a malicious USB host to send crafted RNDIS SET messages with out-of-range offsets. Exploitation can lead to disclosure of device memory. The issue is fixed in version 2.13.0.
Objenesis versions before 3.6 have a type confusion vulnerability due to instantiator caching keyed on class name, which causes collisions when classes share the same name across different class loaders. This can result in newInstance() returning objects of the wrong class and ClassCastException errors.
danmu_api versions before 1.21.7 have an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configurations if the default TOKEN is used and ADMIN_TOKEN is unset. This enables attackers to set ADMIN_TOKEN, lock out legitimate operators, redirect server URLs potentially causing SSRF, and trigger redeployment.
Dolibarr ERP CRM versions before 24.0.0 have an OS command injection vulnerability in the htdocs/admin/tools/export.php script. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting specially crafted mysqldump values that chain commands using & characters. Successful exploitation enables execution of arbitrary operating system commands with the web server user's privileges. The vulnerability is fixed in version 24.0.0.
Dolibarr ERP CRM versions 19.0.0 up to but not including 23.0.4 contain an SQL injection vulnerability in the third-party bankaccounts REST endpoint. Authenticated API users with societe/creer permission can exploit this flaw by injecting SQL via the type field, potentially reading sensitive data such as password hashes and API keys through time-based blind subqueries. The vulnerability is fixed in version 23.0.4.
RosarioSIS versions before 12.9.2 have a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, enabling them to act with the administrator's privileges.
MacCMS v10 through version 2026.1000.4056 has a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to manipulate arbitrary mac_comment database columns, including user_id. By exploiting this, attackers can post anonymous comments that appear attributed to any registered user, showing that user's avatar and impersonating them.
MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchases of VIP upgrades and paid content. The vulnerability has a low CVSS score of 2.3 and does not have known exploits in the wild.
MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability in the password recovery mechanism. The function check_msg() does not properly verify the recipient of the recovery code, allowing attackers to reset any user's password by submitting a recovery code sent to their own mailbox but associating it with the victim's email or phone number. This flaw enables account takeover without authentication.
CVE-2026-116213 is an arbitrary file read vulnerability in Webasyst Framework versions up to 4.4.0. It arises from improper validation of symbolic link targets when authenticated users with theme management rights upload themes containing symlinks. This flaw allows reading sensitive files such as wa-config/db.php or /etc/passwd via the public theme path.
CVE-2026-116212 is a stored cross-site scripting (XSS) vulnerability in the Webasyst Framework up to version 4.4.0, specifically in the Photos app. Authenticated backend users with album edit rights can inject malicious JavaScript via the album url parameter, which is not properly escaped in the DialogAlbumSettings.html file. This allows execution of arbitrary JavaScript in administrator backend sessions.
CVE-2026-116210 is a cross-site request forgery (CSRF) vulnerability in the Webasyst Framework's Photos app up to version 4.4.0. The vulnerability arises because the Photos app does not enable the framework's opt-in CSRF protection, allowing attackers to trick logged-in users into submitting forged POST requests. These requests can delete photos or modify access rights without user consent.
CVE-2026-116281 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19 affecting the ListProfiles function in the Profile Controller component. The vulnerability allows local attackers to access sensitive information. This issue is resolved by upgrading to version 5.2.0.
CVE-2026-107157 is an out-of-bounds read vulnerability in the Qt Framework's QCborValue::fromCbor() function. It affects multiple versions of Qt from 5.12.0 through 6.8.8 and from 6.9.0 through 6.11.2. The vulnerability has a low CVSS score of 2.0, indicating limited impact and exploitability. There are no known exploits in the wild, and no official patch information is provided in the available data.
An Open Redirect vulnerability (CWE-601) exists in Mautic's public form submission endpoint (/form/submit). After submitting a form, the application redirects users to a return URL supplied in the submission without verifying if it points to a trusted host. This allows unauthenticated attackers to redirect visitors from a legitimate Mautic domain to arbitrary external sites, potentially phishing or malware sites. The vulnerability affects Mautic versions >=1.0.0-beta <5.2.12, >=6.0.0 <6.0.10, and >=7.0.0 <7.2.2. Fixed versions are 5.2.12, 6.0.10, and 7.2.2.
CVE-2026-115195 is a broken access control vulnerability in the Mautic Stats API endpoint (/api/stats/{table}) that allows any authenticated API user to read data from internal tables without proper authorization. This includes sensitive information such as application audit logs, user actions, contact personal data, visitor IP addresses with geolocation, and tracked redirect URLs. The flaw exists because administrator-only restrictions were never enforced and tables without explicit permission mappings were readable by default. The vulnerability affects multiple Mautic core versions and has been fixed in versions 5.2.12, 6.0.10, and 7.2.2.
CVE-2026-115194 is a path traversal vulnerability in the Mautic Asset API that allows an authenticated user with asset creation permissions to register and publish arbitrary files readable by the web server. This results in unauthorized disclosure of sensitive files, including configuration files containing database and SMTP credentials, via a public URL without authentication.