AiSOC versions from 12.1.0 up to but not including 23.3.0 have a missing authentication vulnerability. This flaw allows unauthenticated attackers to query the enrichment service via specific Next.js console rewrite routes, potentially retrieving threat intelligence data and consuming commercial API quota by setting a force parameter.
An incorrect authorization vulnerability exists in Apache APISIX versions 1.4.0 through 3.19.0. Authenticated users with any one of a route's required permissions or scopes can access the protected upstream, bypassing other required permissions and HTTP method restrictions. This issue is fixed in version 3.20.0.
A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to access sensitive .env configuration files and exfiltrate critical credentials. The vulnerability was mitigated around October 29, 2026, by implementing a sandbox component.
Apache APISIX versions 3.8.0 through 3.19.0 are affected by an authentication bypass vulnerability due to spoofing. This occurs when multi-authentication falls back from wolf-rbac to another authenticator, allowing client-supplied Wolf identity headers to persist and potentially mislead downstream services about the authenticated identity. The issue is fixed in version 3.20.0.
Catalis/Patriot Properties WebPro 5.0 contains a SQL injection vulnerability that allows remote unauthenticated attackers to execute arbitrary SQL queries on the underlying MSSQL database. This can lead to unauthorized access and exfiltration of sensitive property and taxpayer information. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Omnispace Agora Project versions through 26.10.0 have an open redirect vulnerability in the Ctrl.php redir() function. This flaw allows remote attackers to manipulate the objUrl parameter to redirect users to arbitrary external URLs. Such redirects can be exploited for phishing attacks and credential theft by tricking users into visiting malicious sites.
MRBS versions prior to 1.13.0 have a CSV formula injection vulnerability that allows authenticated users to inject malicious spreadsheet formulas. This occurs because the escape() function in web/report.php does not properly neutralize leading formula characters. Attackers can embed formulas in booking names, descriptions, or custom fields that execute when privileged users open exported CSV reports, potentially leading to data exfiltration or command execution via DDE.
Omnispace Agora Project versions through 26.10.0 have a vulnerability in token generation where the md5Id token can be predicted due to a missing dateCrea value. This allows unauthenticated attackers to compute valid tokens and access private calendar events by exploiting the misc&action=DisplayIcal endpoint without authentication.
Omnispace Agora Project versions through 26.10.0 have an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can exploit this flaw by manipulating the reloadMailTypeId parameter in the CtrlMail.php component to access private mail messages of other users without proper ownership checks. This leads to unauthorized disclosure of sensitive communication content.
An integer overflow vulnerability exists in picoquic versions before 2026.11.05.3e2e3d3 in the picoquic_decode_time_stamp_frame() function. This flaw allows remote QUIC peers negotiating the TIME_STAMP extension to send oversized TIME_STAMP values that cause integer overflow, corrupting stored timestamps. The corruption affects round-trip time (RTT) and bandwidth estimation, leading to degraded congestion control performance.
MRBS versions prior to 1.13.0 have a password reset poisoning vulnerability that allows unauthenticated attackers to forge the Host header when the $url_base configuration is unset. This enables attackers to cause password reset emails to contain links pointing to attacker-controlled hosts, potentially capturing reset keys and taking over user accounts, including administrators.
Omnispace Agora Project versions through 26.10.0 have a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to perform privileged actions, such as creating administrator users, by exploiting the merging of $_GET and $_POST parameters without requiring an anti-CSRF token. The vulnerability leverages the absence of CSRF protection combined with SameSite=Lax cookie behavior on top-level navigations, enabling attackers to craft malicious links or auto-navigating pages that issue GET requests to execute unauthorized actions.
Omnispace Agora Project versions through 26.10.0 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious HTML markup via imported directory data or uploaded CSV files. The vulnerability arises because input values are only UTF-8 encoded without proper HTML escaping, enabling crafted CSV cells to execute arbitrary scripts in the administrator's browser during import.
Gameyfin versions before 2.6.2 have a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by accessing certain endpoints. Attackers can call Hilla endpoints annotated with @AnonymousAllowed, including synchronous endpoint methods like GameEndpoint.sync, which are not checked by LiveSubscriptionSecurity. This enables retrieval of game catalog metadata, libraries, platforms, plugins, and game requests without authentication.
MRBS versions prior to 1.13.0 have an LDAP injection vulnerability in the AuthLdap.php component. This flaw allows attackers with valid directory credentials but outside the required group to bypass access restrictions by submitting specially crafted usernames that manipulate LDAP filters.
SQLBot versions through 1.10.3 use unsalted MD5 hashing for storing local account passwords in the sys_user.password field. This weak hashing method allows attackers who access the user table to recover passwords, including administrator credentials, via precomputed hash tables or GPU-accelerated cracking. The vulnerability arises from the use of md5pwd() in security.py, which does not apply salting to the hashes.
Goose CLI versions from 1.35.0 up to but not including 1.53.0 contain a local code execution vulnerability. This flaw allows attackers to execute arbitrary commands by manipulating the diff.external setting in a repository's .git/config file. When a victim runs the 'goose review' command on a crafted repository, it triggers git diff without the --no-ext-diff option, enabling command execution as the user and potentially exposing sensitive credentials and API keys.
C-Kermit versions prior to 11.1.515 have an OS command injection vulnerability that allows remote clients to execute arbitrary shell commands. This occurs when unquoted arguments are supplied to the REMOTE WHO or REMOTE SPACE commands, enabling attackers to append shell metacharacters to arguments passed to syscmd(). This vulnerability can be exploited even if the DISABLE HOST setting is enabled.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a remote code execution vulnerability. This flaw allows attackers to execute shell commands on servers even when host commands are disabled by exploiting REMOTE QUERY evaluation. Attackers can invoke the command function or define and execute macros to bypass restrictions, leading to full compromise. The vulnerability has a high severity score of 8.1 CVSS v3.1.
A local file disclosure vulnerability exists in agent-device versions from 0.21.36 up to but not including 0.21.37. Authenticated remote users can exploit this flaw by sending commands that open file:// URLs via the /rpc interface, allowing them to read any plaintext file accessible by the daemon account.