MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending multiple concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchase of VIP upgrades and paid content.
Webasyst Framework versions through 4.4.0 have a cross-site request forgery (CSRF) vulnerability in the Photos app. This flaw allows remote attackers to trick logged-in users into submitting forged POST requests that can delete photos or change access rights. The vulnerability exists because the Photos app does not enable the framework's opt-in CSRF protection.
Webasyst Framework versions through 4.4.0 have an arbitrary file read vulnerability in the waArchiveTar::writeItem() function. This flaw allows authenticated users with theme management rights to upload theme archives containing symbolic links that point to sensitive files such as wa-config/db.php or /etc/passwd. These files can then be read through the public theme path, potentially exposing sensitive configuration or system information.
MacCMS versions up to 2026.1000.4056 have a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to set arbitrary mac_comment fields, including user_id, enabling them to submit comments that appear to come from any registered user. As a result, attackers can impersonate members by displaying their avatars alongside the forged comments.
A Server Side Request Forgery (SSRF) vulnerability exists in the hackney_url component of the benoitc hackney library. It arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots. This causes the library to bypass allowlist checks and connect to unintended IP addresses. The issue affects hackney versions from 4.0.1 up to but not including 4.9.0.
A vulnerability in JIZHICMS up to version 2.5.6 affects the Pay function in the Front-end Order Handler component. The flaw involves improper authorization due to manipulation of the 'orderno' argument, allowing remote attackers to exploit this issue. The vulnerability has a medium severity rating with a CVSS score of 4.3. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.
Webasyst Framework versions through 4.4.0 have a stored cross-site scripting (XSS) vulnerability in the Photos app. Authenticated backend users with album edit permissions can inject JavaScript via the album url parameter. This injection occurs because the url parameter is not properly escaped in the DialogAlbumSettings.html file, allowing script execution in administrator backend sessions.
Dolibarr ERP CRM versions prior to 24.0.0 contain an OS command injection vulnerability in the htdocs/admin/tools/export.php file. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting a specially crafted mysqldump value that chains commands using & characters. Exploitation enables execution of arbitrary operating system commands with the privileges of the web server user.
An improper certificate validation vulnerability in hackney_ssl within the benoitc hackney HTTP client library allows an on-path attacker to impersonate a server pinned to a private certificate authority. The flaw arises because hackney_ssl's partial_chain callback trusts any certificate chain ending in a publicly trusted root, even when a private CA is pinned. Hostname verification still applies, so the attacker must have a publicly trusted certificate for the target hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.
A vulnerability in the hackney HTTP client library (versions 2.0.0 up to but not including 4.9.0) allows credentials such as basic_auth and cookies to be leaked during redirects. When follow_redirect is enabled, redirects from HTTPS to HTTP or to a different port on the same host resend sensitive Authorization and Cookie headers in cleartext or to unintended services. This can expose credentials to on-path attackers.
Certain versions of Harbor contain a server-side request forgery (SSRF) vulnerability in the webhook delivery component. This flaw allows an authenticated attacker with ProjectAdmin permissions to configure webhook policies targeting private or link-local IP addresses. When triggered, Harbor's jobservice sends unauthenticated HTTP POST requests to these internal addresses. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata services.
CVE-2026-112880 is a vulnerability in the hackney_http_connect module of the benoitc hackney HTTP client library. It allows HTTP Request/Response Splitting due to improper neutralization of CRLF sequences in HTTP headers. Specifically, the proxy_auth_fun callback's return value is inserted into the Proxy-Authorization header without validation, enabling injection of additional header lines if it contains CR, LF, or NUL bytes. This affects hackney versions from 2.0.0 up to but not including 4.9.0.
A critical vulnerability in the CreditNirvana Collections Platform's login service allows unauthenticated remote attackers to bypass authentication and authorization controls. Exploitation enables attackers to enumerate users, impersonate arbitrary users including administrators, and access or modify sensitive data with the privileges of the impersonated accounts.
The CreditNirvana Agentic AI Call Centre application contains a vulnerability due to a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. With the extracted key, the attacker could make arbitrary API calls to access sensitive call transcripts and recordings through the application's API.
An out-of-bounds read vulnerability exists in the QCborValue::fromCbor() function of the Qt Framework. This flaw could potentially allow reading memory outside the intended buffer boundaries. The vulnerability has a medium severity rating with a CVSS score of 5.8. No affected versions or patch information are currently provided.
CVE-2026-107656 is a critical authentication bypass vulnerability affecting multiple versions of Fortinet FortiSandbox and FortiSandbox PaaS. The flaw allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests. The affected versions include FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, all versions of 4.2, and corresponding FortiSandbox PaaS versions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
NexoPOS version 6.2.4 contains a critical directory traversal vulnerability in its api/update endpoint. This flaw allows an attacker to access files and directories outside the intended scope, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high severity with impacts on confidentiality, integrity, and availability.
OpenHands Software Agent SDK versions before 1.52.0 have a critical unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with no authentication enabled by default. This allows attackers who can access the container port to execute arbitrary shell commands as root, access mounted workspaces, and read plaintext secrets.
CVE-2026-116367 is a medium severity vulnerability in DeepSeek Harness versions 0.1.0-rc.0 through 0.1.0-rc.5. It affects the createContext function in the sandbox.ts file, resulting in a sandbox issue that can be exploited remotely. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
A security vulnerability (CVE-2026-49825) was identified in the python-lxml library's HTML cleaner component, where a missing xlink:href attribute allows a URL bypass. This issue affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued an important security update to address this vulnerability.