MacCMS versions up to 2026.1000.4056 have a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to set arbitrary mac_comment fields, including user_id, enabling them to submit comments that appear to come from any registered user. As a result, attackers can impersonate members by displaying their avatars alongside the forged comments.
A Server Side Request Forgery (SSRF) vulnerability exists in the hackney_url component of the benoitc hackney library. It arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots. This causes the library to bypass allowlist checks and connect to unintended IP addresses. The issue affects hackney versions from 4.0.1 up to but not including 4.9.0.
A vulnerability in JIZHICMS up to version 2.5.6 affects the Pay function in the Front-end Order Handler component. The flaw involves improper authorization due to manipulation of the 'orderno' argument, allowing remote attackers to exploit this issue. The vulnerability has a medium severity rating with a CVSS score of 4.3. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.
Webasyst Framework versions through 4.4.0 have a stored cross-site scripting (XSS) vulnerability in the Photos app. Authenticated backend users with album edit permissions can inject JavaScript via the album url parameter. This injection occurs because the url parameter is not properly escaped in the DialogAlbumSettings.html file, allowing script execution in administrator backend sessions.
Dolibarr ERP CRM versions prior to 24.0.0 contain an OS command injection vulnerability in the htdocs/admin/tools/export.php file. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting a specially crafted mysqldump value that chains commands using & characters. Exploitation enables execution of arbitrary operating system commands with the privileges of the web server user.
An improper certificate validation vulnerability in hackney_ssl within the benoitc hackney HTTP client library allows an on-path attacker to impersonate a server pinned to a private certificate authority. The flaw arises because hackney_ssl's partial_chain callback trusts any certificate chain ending in a publicly trusted root, even when a private CA is pinned. Hostname verification still applies, so the attacker must have a publicly trusted certificate for the target hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.
A vulnerability in the hackney HTTP client library (versions 2.0.0 up to but not including 4.9.0) allows credentials such as basic_auth and cookies to be leaked during redirects. When follow_redirect is enabled, redirects from HTTPS to HTTP or to a different port on the same host resend sensitive Authorization and Cookie headers in cleartext or to unintended services. This can expose credentials to on-path attackers.
Certain versions of Harbor contain a server-side request forgery (SSRF) vulnerability in the webhook delivery component. This flaw allows an authenticated attacker with ProjectAdmin permissions to configure webhook policies targeting private or link-local IP addresses. When triggered, Harbor's jobservice sends unauthenticated HTTP POST requests to these internal addresses. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata services.
CVE-2026-112880 is a vulnerability in the hackney_http_connect module of the benoitc hackney HTTP client library. It allows HTTP Request/Response Splitting due to improper neutralization of CRLF sequences in HTTP headers. Specifically, the proxy_auth_fun callback's return value is inserted into the Proxy-Authorization header without validation, enabling injection of additional header lines if it contains CR, LF, or NUL bytes. This affects hackney versions from 2.0.0 up to but not including 4.9.0.
A critical vulnerability in the CreditNirvana Collections Platform's login service allows unauthenticated remote attackers to bypass authentication and authorization controls. Exploitation enables attackers to enumerate users, impersonate arbitrary users including administrators, and access or modify sensitive data with the privileges of the impersonated accounts.
The CreditNirvana Agentic AI Call Centre application contains a vulnerability due to a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. With the extracted key, the attacker could make arbitrary API calls to access sensitive call transcripts and recordings through the application's API.
An out-of-bounds read vulnerability exists in the QCborValue::fromCbor() function of the Qt Framework. This flaw could potentially allow reading memory outside the intended buffer boundaries. The vulnerability has a medium severity rating with a CVSS score of 5.8. No affected versions or patch information are currently provided.
CVE-2026-107656 is a critical authentication bypass vulnerability affecting multiple versions of Fortinet FortiSandbox and FortiSandbox PaaS. The flaw allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests. The affected versions include FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, all versions of 4.2, and corresponding FortiSandbox PaaS versions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
NexoPOS version 6.2.4 contains a critical directory traversal vulnerability in its api/update endpoint. This flaw allows an attacker to access files and directories outside the intended scope, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high severity with impacts on confidentiality, integrity, and availability.
OpenHands Software Agent SDK versions before 1.52.0 have a critical unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with no authentication enabled by default. This allows attackers who can access the container port to execute arbitrary shell commands as root, access mounted workspaces, and read plaintext secrets.
CVE-2026-116367 is a medium severity vulnerability in DeepSeek Harness versions 0.1.0-rc.0 through 0.1.0-rc.5. It affects the createContext function in the sandbox.ts file, resulting in a sandbox issue that can be exploited remotely. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
A security vulnerability (CVE-2026-49825) was identified in the python-lxml library's HTML cleaner component, where a missing xlink:href attribute allows a URL bypass. This issue affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued an important security update to address this vulnerability.
Security Fix(es):
* golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate
certificates (CVE-2026-111943)
* golang: golang crypto/x509: Denial of Service via excessive processing of
DNS SAN entries (CVE-2026-27145)
* golang: Go encoding/asn1: Denial of Service via excessive recursion in
Unmarshal (CVE-2026-33818)
* golang: Golang MIME: Denial of Service via maliciously-crafted MIME
header (CVE-2026-42504)
* golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial
of Service (CVE-2026-56853)
* golang: Go html/template: Cross-Site Scripting via pathological input
(CVE-2026-56858)
* golang: golang net/url: Denial of Service from quadratic complexity in
path resolution (CVE-2026-56860)
* golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate
messages (CVE-2026-56862)
* golang: golang: Denial of Service via crafted HTTP Range headers
(CVE-2026-78667)
* net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of
Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* golang: crypto/tls: Denial of Service via multiple ECH outer extension
references (CVE-2026-97031)
* golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions.
Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.