`KeyShares::from_backup_format` (the Shamir backup share reader, public since
0.2.0, the crate's first release) accepted a share whose x coordinate is 0,
and `KeyShares::recover_private_key` interpolates the shares at x = 0 to
recover the key. At an x of 0 the interpolation answers that share's y value
alone, so an attacker who supplies one share in that form — with the share's
integrity tag ground to match the honest set's — chooses the recovered key
outright. The non-canonical zero x = p works the same way, and a repeated x
past the threshold window also passed.
An application that recovers a Shamir backup from shares it did not produce —
a custodian's medium, a share pasted by hand, a set restored from another
writer — could be handed the attacker's key as the recovered one. A set the
crate's own writer produces never carries such a share; the door is the
reader.
0.8.7 refuses such a set before interpolating (the 0.9 line's next prerelease
carries the same refusal). Where upgrading is not possible, before recovering
split each share on `.` into four fields, base58-decode the x field, and
refuse the set if it decodes to zero (the one-character field `1`, or a value
at or above the field prime) or if two shares carry the same x.
The vulnerability lies in the way application credentials are handled within the BOSH deployment.
bosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)
An unauthenticated SQL Injection vulnerability exists in the getVpnData function of MB connect line's mbCONNECT24 product. A remote attacker with high privileges can exploit this flaw to execute arbitrary SQL commands, potentially leading to a total loss of confidentiality. The vulnerability affects versions from 1.0.0 up to and including 2.20.0. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-125836 is a Cross-Site Request Forgery (CSRF) vulnerability in the Simple JWT Login plugin by Nicu Micle. It affects versions from 0 up to and including 3.6.8. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.
CVE-2026-126991 is a code injection vulnerability in the Wikidata Lookup expansion module (wiki.py) of MISP misp-modules. An authenticated user can inject SPARQL syntax into queries sent to the Wikidata SPARQL endpoint, potentially altering query logic or causing error conditions that leak internal information. The vulnerability requires authenticated access and use of the wiki expansion module. It does not directly compromise the MISP server or stored data.
Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in the invoice import feature. An authenticated user with permission to create invoices can inject HTML into an invoice status field. When another authenticated user opens the invoice edit form, the injected markup is rendered unsafely, allowing execution of attacker-controlled scripts within the Akaunting origin.
CVE-2026-82292 is a low-severity NULL pointer dereference vulnerability in the Qt Framework's QDomDocument::setContent() function within the Qt XML module (qtbase). It affects Qt versions from 4.1.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.3. The flaw could cause application crashes or denial of service when processing crafted XML content. A fix is available in Qt versions 6.8.9 and 6.11.3.
KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability. No specific affected versions or technical details are provided. There is no information about patches or exploits in the wild.
CVE-2026-113408 is a low-severity path traversal vulnerability in Git that allows an attacker to write to arbitrary files by cloning and committing to a malicious repository. This flaw affects specific Git versions including 2.50.1 through 2.56.0. The vulnerability requires local access with user interaction and does not impact confidentiality or availability.
Zohocorp ManageEngine M365 Manager Plus versions prior to 4818 contain a missing authorization vulnerability (CWE-862) in the delegated administration interface. An authenticated technician with insufficient permission validation can escalate privileges beyond their intended scope. This flaw could lead to remote code execution during administrative processing. The vulnerability is rated critical with a CVSS score of 9.9. A fix is available in version 4818.
Zohocorp ManageEngine AssetExplorer and related products contain a critical SQL Injection vulnerability (CWE-89) in the Reports module. Authenticated users with the Create Query Reports permission can exploit this flaw to execute arbitrary commands on the underlying server. Versions prior to 7860 for AssetExplorer, prior to 15290 for ServiceDesk Plus, and prior to 15150 for ServiceDesk Plus MSP and SupportCenter Plus are affected. This vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability.
CVE-2026-87772 is an incorrect authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's Pardus About software. It allows privilege escalation in versions prior to 1.2.5. The vulnerability has a high severity with a CVSS score of 7.8. A fixed version, 1.2.5, is available to address this issue.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include information disclosure, denial of service, remote code execution, use-after-free, and heap buffer overflow issues affecting various protocol components such as Save Session Info PDU, Surface Bits command, Server Redirection PDU, RDPGFX ResetGraphics PDU, URBDRC channel, DRDYNVC parser, RPC gateway, WinPR, and LB_LOAD_BALANCE_INFO routing token. The vulnerabilities affect Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products. Red Hat has issued security updates to address these issues.
The User Verification by PickPlugins WordPress plugin versions before 2.0.49 lacks rate limiting on the verification step of its one-time-password login and does not expire generated codes. This allows unauthenticated attackers to brute force verification codes and gain unauthorized access to any user account, including administrators, when the code is configured to use digits only.
The Clockinator Lite WordPress plugin versions before 1.1.0 have a vulnerability where the plugin does not verify authorization or ownership when updating leave requests. This flaw allows unauthenticated users to modify any leave record, including approving, rejecting, or reassigning leave requests to other users.
The Ultimate Addons for Elementor Forms WordPress plugin versions before 1.0.8 contain a vulnerability where the plugin does not properly validate the file extension of uploaded files. This flaw allows unauthenticated users to upload arbitrary files, including PHP scripts, potentially leading to remote code execution on the affected system.
The ContentPen WordPress plugin versions before 1.1.1 expose their REST API key to unauthenticated users. This exposure allows attackers to create posts containing unfiltered JavaScript, resulting in stored cross-site scripting (XSS) that executes in the browsers of any visitors, including administrators.
The TI WooCommerce Wishlist WordPress plugin versions prior to 2.0.7 contain a vulnerability where user input is not properly sanitized or escaped before being used in a SQL statement on a front-end endpoint. This flaw allows unauthenticated users to conduct SQL injection attacks.
A vulnerability in The Directorist WordPress plugin versions before 8.11.1 allows users with Subscriber-level accounts and above to bypass listing moderation by changing their own listing status from pending to published. This flaw enables unauthorized publication of listings without administrator approval.
The Order Tracking WordPress plugin versions prior to 3.6.2 have a vulnerability where the plugin does not verify that a visitor owns the customer or sales representative account for which order information is requested. Account numbers are sequential by default, enabling unauthenticated users to access the order history of any customer or sales representative, including order contact email addresses in some versions.