Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have a vulnerability that allows low-privilege editors to cause uncontrolled resource consumption. By using the #set_recurring_event parser function without specifying an end date and supplying a large limit parameter, attackers can generate millions of date subobjects. This leads to exhaustion of CPU, memory, and database resources. The issue is fixed in version 7.3.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have an authorization vulnerability that allows ordinary editors to permanently protect pages by adding a specific annotation. This flaw occurs when the $smwgEditProtectionRight setting is enabled, causing indefinite edit and move restrictions to be applied without verifying the author's permissions, effectively locking out other editors and administrators.
SemanticMediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:Ask feature. This flaw occurs because certain separator parameters are output without proper HTML escaping in various result printers. Unauthenticated attackers can exploit this by crafting malicious Special:Ask links that execute JavaScript in the victim's browser within the wiki's origin, potentially stealing session information or CSRF tokens. The vulnerability is fixed in version 7.3.1.
SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the unescaped default parameter in JsonResultPrinter. Exploitation involves tricking users into clicking a specially crafted Special:Ask link with a zero-result query and request_type=special_page, leading to JavaScript execution in the context of the wiki origin. The vulnerability was fixed in version 7.3.1.
Semantic MediaWiki versions 7.3.0 before 7.3.1 have a missing authorization vulnerability in the smwtask API module. This flaw allows unauthenticated attackers to run queued jobs and force store updates using the public anonymous CSRF token. Exploitation can lead to arbitrary job execution in unlimited quantities, unauthorized updates on sysop-protected pages, page title leakage, and resource exhaustion.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain an algorithmic complexity vulnerability in the TermParser::normalize_compact_form() function. This flaw allows unauthenticated attackers to submit specially crafted long search terms with many distinct in:(...) or has:(...) expressions to the Special:Search page, causing quadratic CPU consumption and exhausting PHP search workers when the extended search engine is enabled. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions 3.0.0 up to but not including 7.3.1 contain an uncontrolled recursion vulnerability in the LegacyParser::getSubqueryDescription() function. This flaw allows unauthenticated attackers to submit deeply nested queries via the action=ask API, causing excessive CPU and memory consumption that can tie up server request workers. The vulnerability is fixed in version 7.3.1.
CVE-2026-117530 is a vulnerability in JetBrains Junie CLI versions before 26.8.17 where incomplete validation of allowlisted commands allowed command execution. This flaw was fixed in version 26.8.17. The vulnerability has a CVSS score of 6.7, indicating a medium severity impact with high confidentiality, integrity, and availability consequences but requiring local attack vector with high attack complexity and low privileges.
CVE-2026-82121 is an origin validation error vulnerability affecting Hitachi HiRDB Server versions 9 and 10 prior to 10-12-01. The flaw allows an attacker to bypass origin checks, potentially leading to unauthorized data disclosure. The vulnerability has a high severity with a CVSS score of 7.5, indicating network exploitable conditions without privileges or user interaction. A fix is available in HiRDB Server version 10-12-01.
This vulnerability involves a hardcoded key in the GSS Deployment Server installation that, if obtained by an attacker, could allow decryption of sensitive credentials including domain/service account passwords, task run-as credentials, and sysprep passwords. The flaw has a high severity rating with a CVSS score of 7.6. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.
CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --seeder pip and --download options. In this scenario, virtualenv skips its wheel digest verification and allows pip to fetch wheels from an index without verifying their SHA-256 digest against PyPI metadata. This can lead to installation of modified or malicious pip wheels if an attacker controls the index configured in pip.conf. The issue affects virtualenv versions starting from 2.7.3. The vulnerability has a low CVSS score and no known exploits in the wild.
CVE-2026-111460 is a vulnerability in the Moxa OnCell G3150A-LTE Series involving the use of a hard-coded cryptographic key. An unauthenticated remote attacker can potentially obtain this shared key material if the device has not regenerated its cryptographic keys. This exposure allows the attacker to impersonate affected devices, risking the confidentiality and integrity of management communications. The vulnerability affects version 1.0.0 of the product. The CVSS 4.0 score is 7.7, indicating high severity.
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 contain a vulnerability where the direction of file-transfer credentials is not enforced on file-repository operations. This flaw allows an authenticated attacker with read-only access to a file to misuse the upload endpoint to append data to files, potentially overwriting repository objects and consuming storage within certain operational limits.
Psono Server versions 5.3.5 through 7.2.3 contain a vulnerability where a permission class fails to enforce token write scope when claiming a device code. An authenticated attacker with a restricted API key-derived session can claim a device code they control and escalate to a full read-write session valid for up to 365 days. This escalation bypasses the original token's scope and lifetime restrictions but does not bypass two-factor authentication or disclose plaintext secrets.
CVE-2026-117472 is an authorization vulnerability in esaqa GmbH's Psono Server CE and EE versions 4.0.33 through 7.2.3. The issue occurs when deployments use a URL_PREFIX configuration, causing the bulk-secret-read endpoint to incorrectly authorize requests with write scope instead of read scope. This allows an authenticated attacker with a write-enabled but read-disabled API key to retrieve encrypted secret data and nonces without proper read permissions. Default configurations without URL_PREFIX are not affected. The vulnerability is fixed in version 7.2.4.
Psono Server CE and EE versions 0.1.0 through 7.2.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker can cause the server to connect to arbitrary HTTPS hosts on port 443 without an allowlist or explicit timeout, potentially revealing internal DNS and service reachability information. TLS certificate validation is enforced, limiting protocol and port access. The flaw can also cause server worker threads to be occupied by unresponsive targets until OS timeouts occur. This vulnerability is fixed in version 7.2.4.
Psono Server CE & EE versions 3.1.0 through 7.2.3 contain an authentication bypass vulnerability due to improper handling of WebAuthn challenges. An attacker with the user's password and a captured valid WebAuthn assertion can replay the assertion multiple times to bypass the second factor authentication. This vulnerability was fixed in version 7.2.4.