Threat Intelligence Database

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges.

Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0.

Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite stack state, and execute commands with root privileges. Successful exploitation may allow an authenticated adjacent-network attacker to take control of the affected camera, modify camera behavior, access sensitive local configuration, and disrupt device availability.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 use cryptographic algorithms that are weaker than expected. This weakness could allow an attacker to decrypt highly sensitive information. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance is provided in the available data.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-supplied input is not properly sanitized or HTML-encoded before being stored and rendered by the web application. An authenticated attacker can inject malicious JavaScript payloads that execute when other users view the affected pages. The vulnerability has a CVSS 3.1 score of 7.4, indicating high severity.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a vulnerability classified as CWE-80, involving improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue. A remotely authenticated attacker with limited privileges could inject malicious HTML code that executes in the context of the victim's browser when viewed. This vulnerability has a medium severity rating with a CVSS score of 5.4.

A vulnerability in the honojs hono Web application framework versions 4.12.4 through 4.13.10 allows unauthorized disclosure of static files protected by upstream middleware. The serveStatic component performs double decoding of a malformed percent-encoded path, causing it to bypass static prefix protections. This issue is fixed in version 4.13.11.

The open-source AI coding project OpenCode experienced a security breach that exposed API keys used by a small number of its users with external providers. The incident involves unauthorized access to sensitive credentials, potentially impacting the security of those external services. No detailed technical information or exploit methods have been disclosed. There is no indication of active exploitation in the wild or a vendor patch. The affected versions are not specified.

CVE-2026-112377 is a critical vulnerability in CCC Attestation SIG's attested-tls-poc up to commit 731ca82 (version 0). The flaw involves a failure to bind early attestation Evidence to the TLS connection, enabling attackers who have extracted an attested TLS private key to relay valid Evidence from a genuine attester. This allows impersonation of the attested workload and interception of data by replaying the relying party's nonce and Evidence.