Threat Intelligence Database

A missing authorization vulnerability in Home Assistant core prior to version 2026.5.0 allows untrusted iOS apps to trigger automations silently by forwarding tag links (NFC or QR) without user validation. This flaw enables unauthorized automation execution without user interaction. The issue is fixed in version 2026.5.0.

Home Assistant core prior to version 2026.8.1 contains a missing authorization vulnerability in its Companion app. The app treats tag links (NFC or QR) received via an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. This allows any untrusted app on the device to forward arbitrary tags to Home Assistant, triggering automations silently and without user interaction.

Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker-chosen OAuth2 parameters including client_id, client_secret, redirect_uri, and scope to silently register a persistent OAuth2 application, enabling interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client.

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.