CWE-99 vulnerabilities

Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers.

CVE-2026-114726 is a mail header injection vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw exists in the Bounce (resend) action where control characters in the From display-name are not properly stripped, allowing injection of arbitrary headers. This issue was fixed in versions 1.6.20 and 1.7.5.

CVE-2026-114725 is a mail header injection vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The function rcmail_sendmail only sanitized newline characters in the Subject and Organization headers, leaving other headers such as References, In-Reply-To, Message-ID, and From vulnerable to injection. This allows a remote authenticated attacker to inject arbitrary headers into outgoing emails. The issue was fixed by normalizing whitespace in all string header values in versions 1.6.20 and 1.7.5.

CVE-2026-114717 is a mail header injection vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.5. The flaw occurs when forwarding a message as an attachment, where the subject line is used directly to name the attachment. If the subject contains CRLF sequences, it can inject arbitrary MIME headers into the outgoing message. This issue was fixed by collapsing whitespace in the generated attachment name in versions 1.6.20 and 1.7.5.

CVE-2026-114716 is a mail header injection vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The flaw arises from improper validation of the media type in inline image data URIs, allowing a remote authenticated attacker to inject arbitrary MIME part headers into outgoing messages. This issue was fixed by validating the media type with rcube_mime::is_mimetype_valid().

CVE-2026-50218 is a high-severity vulnerability in Akamai Guardicore Platform Agent (GPA) versions before 7.4. The GPA client improperly validates JWT tokens used for seeding, allowing an attacker to inject arbitrary parameters via a spoofed JWT token. This can lead to unauthorized reconfiguration and full compromise of the application's functionality. The attack requires convincing a user to interact with a malicious link or knowledge of the IDP URL used by an enrolled client. A patch is available to address this issue.

Magic: The Gathering Arena (Windows/Steam client) versions 2026.59.30.12801.127931.6 and certain later 2026.60.x builds have a vulnerability where a server-supplied URL from the home-screen carousel is passed directly to the Windows shell without validating the URI scheme or domain. This can allow an attacker controlling carousel content to invoke arbitrary registered URI-scheme handlers on client hosts without user interaction. The vulnerability is classified as CWE-99 (Improper Control of Resource Identifiers) and has a low CVSS score of 3.4.

CVE-2026-106583 is a low-severity vulnerability in OpenSSH before version 10.6 where the presence of a $ or \ character in a command-line username can lead to resource injection. This improper control of resource identifiers could allow injection attacks via crafted usernames. The vulnerability has a CVSS score of 2.5, indicating low impact, with limited integrity impact and no confidentiality or availability impact.

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.

CVE-2026-81524 is a medium severity vulnerability in the MongoDB C Driver where improper sanitization of database and collection name components allows operations to be directed at unintended resources. This occurs when untrusted input is incorporated into these name components, leading to potential resource injection.

CVE-2026-81521 is a high-severity vulnerability in the MongoDB Go Driver affecting the Client.BulkWrite API. It arises from improper control of resource identifiers, where a caller-supplied database name containing a reserved separator character is not escaped before use. This flaw allows an application passing untrusted input as a database name to have writes directed to unintended databases and collections.

Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.

A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.