Apache SIS versions 0.7 through 1.6 have a vulnerability where the software opens linked files from data files without properly restricting their paths. This can lead to opening local files outside the intended directory. The vulnerability affects specific geographic data formats including GML, WKT with datum shift grids, and Landsat GeoTIFF bands. The risk of sensitive information leakage is low because the software stops reading at the first parsing error if the file format is unexpected. Version 1.7 of Apache SIS fixes this issue by restricting file paths to the same directory or a predetermined directory for datum shift grids.
The MongoDB Shell (mongosh) versions prior to 2.14.0 rely on a Node.js runtime that includes a TLS root certificate store containing recoverable eMudhra intermediate CA certificates. This reliance introduces a security vulnerability identified as CVE-2026-115930. The issue can be resolved by updating mongosh to version 2.14.0 or later, which bundles Node.js 24.22.1 or newer. For installations via npm, the Node.js runtime on the host must be updated separately.
The TTLock Android application versions before 9.8.260718 and associated smart-lock firmware contain a vulnerability due to a hardcoded static AES key. This flaw allows attackers within Bluetooth range to decrypt the per-pairing session key during BLE pairing. Exploitation enables unauthorized actions such as unlocking the device, adding fingerprints or access codes, and performing administrative tasks without user authentication or interaction.
A SQL injection vulnerability exists in the SQL storage module of Apache SIS versions 1.0 through 1.6 inclusive. The issue arises when sorting a stream of features, as the sort clause is copied after ORDER BY without properly quoting identifier characters, allowing crafted input to inject SQL code. This vulnerability is fixed in version 1.7.
A weakness in Kameleo up to version 5.0.1.26 affects the Local API component, specifically the /profiles file, allowing remote attackers to cause information disclosure. The issue is mitigated by upgrading to version 5.2.0.
Frappe CRM app versions before 1.89.1 have a missing authorization vulnerability that allows authenticated low-privileged users to access CRM Lead records they should not be able to see. This occurs because the get_contact_by_phone_number API endpoint performs raw database queries without enforcing permission checks, enabling unauthorized disclosure of sensitive lead data by supplying a known phone number.
Mattermost versions up to 11.9, including 11.1.9, 11.5.8, and 11.10.7.0, contain a vulnerability where the Zoom chat line length is not properly validated before slicing. This flaw allows an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription with short continuation lines.
danmu_api versions before 1.21.7 have an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configurations if the default TOKEN is used and ADMIN_TOKEN is unset. Exploitation involves sending POST requests to specific API endpoints to set ADMIN_TOKEN, lock out legitimate operators, redirect server URLs potentially causing SSRF, and trigger redeployment.
Objenesis versions before 3.6 have a type confusion vulnerability due to instantiator caching keyed on class name, which can cause objects from one class loader to be substituted for those of another. This leads to ClassCastException failures when newInstance() returns objects of the wrong class.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain an out-of-bounds read vulnerability in the USB_DeviceCdcRndisSetCommand() function. This flaw arises because the function trusts a host-supplied informationBufferOffset, allowing a malicious USB host to send crafted RNDIS SET messages with out-of-range offsets. Exploiting this vulnerability can lead to disclosure of device memory.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values without proper validation. A malicious USB device can exploit this by supplying crafted descriptors that overflow the fixed-size epList array, leading to heap memory corruption. This can result in code execution or denial of service on the affected system.
A security flaw in Kameleo up to version 5.3.1 affects the CookieController.ListCookies function, allowing remote attackers to manipulate the 'guid' argument to disclose information. The vulnerability is classified as CWE-200 (information disclosure). The vendor was contacted but did not respond, and no patch or fix information is available. The CVSS 3.1 base score is 4.3, indicating a medium severity issue.
A code injection vulnerability exists in AllenAI AllenNLP up to version 2.10.1 in the Registrable.resolve_class_name function. This flaw allows remote attackers to manipulate the Type argument, potentially leading to code execution. The vulnerability affects unsupported versions, and no vendor response or patch is available. Public exploit code exists, increasing the risk of exploitation.
MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password. The flaw exists because the check_msg() function does not verify the recipient of the recovery message, enabling attackers to request a recovery code to their own mailbox and then use it to reset the password of a victim's account via their email or phone.
Kameleo versions up to 5.0.1.26 contain a server-side request forgery (SSRF) vulnerability in the Proxy Validation component. The flaw exists in the InternalController.TestProxy function, where manipulation of the host/port argument can lead to SSRF. This vulnerability can be exploited remotely. The issue is addressed by upgrading to version 5.2.0, which removes the vulnerable route and replaces it with a safer alternative.
RosarioSIS versions prior to 12.9.2 contain a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, enabling them to act with the administrator's privileges.
Dolibarr ERP CRM versions from 19.0.0 up to but not including 23.0.4 contain an SQL injection vulnerability in the third-party bankaccounts REST API endpoint. Authenticated users with societe/creer permission can exploit this flaw by injecting SQL via the 'type' field, potentially reading sensitive data such as password hashes and API keys through time-based blind SQL subqueries.
MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending multiple concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchase of VIP upgrades and paid content.
Webasyst Framework versions through 4.4.0 have a cross-site request forgery (CSRF) vulnerability in the Photos app. This flaw allows remote attackers to trick logged-in users into submitting forged POST requests that can delete photos or change access rights. The vulnerability exists because the Photos app does not enable the framework's opt-in CSRF protection.
Webasyst Framework versions through 4.4.0 have an arbitrary file read vulnerability in the waArchiveTar::writeItem() function. This flaw allows authenticated users with theme management rights to upload theme archives containing symbolic links that point to sensitive files such as wa-config/db.php or /etc/passwd. These files can then be read through the public theme path, potentially exposing sensitive configuration or system information.