Vulnerability Threats

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` that accepts an attacker-controlled `filePath` and returns a presigned S3 `PUT` URL for that exact key. Because the endpoint only checks that the referenced typebot is public and that the referenced block is a file input block, an unauthenticated attacker who knows a valid public `typebotId` and `blockId` can request presigned upload URLs for arbitrary objects in the shared bucket, including `private/...` and other tenants' `public/...` paths. Version 3.17.0 fixes this issue.

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

CVE-2026-71290 is a vulnerability in Apache HttpComponents Client 5.4-alpha and newer versions where the async HttpClient does not properly enforce TLS hostname verification. The HostnameVerificationPolicy#BUILTIN setting is ineffective in the async client, allowing an attacker who can intercept and modify traffic to impersonate a server by presenting a valid certificate for a different domain. The classic HttpClient version is not affected. Users are advised to upgrade to version 5.6.4 or later to address this issue.

CVE-2026-63177 is an authorization vulnerability in cisagov Malcolm, a network traffic analysis tool. Before version 26.07.0, the role-based access control in the Nginx OpenResty Lua layer evaluates the raw request URI without normalization, while Nginx routes requests using a normalized path. This discrepancy allows an authenticated low-privilege user to bypass access controls by using path traversal segments, gaining unauthorized access to restricted backend resources. The issue is fixed in version 26.07.0.

CVE-2026-63134 is a path traversal vulnerability in cisagov Malcolm, a network traffic analysis tool suite. Prior to version 26.07.0, the safe-extract.py script uses libarchive's secure flags but creates directories without proper traversal protection, allowing crafted archive entries with '../' sequences or absolute paths to create directories outside the intended extraction location. This issue is fixed in version 26.07.0.

CVE-2026-63133 is a resource exhaustion vulnerability in cisagov Malcolm prior to version 26.07.0. The safe-extract.py script extracts uploaded archives without limits on entry count, directory depth, total entries, or output size. A malicious archive with many entries can cause unbounded filesystem object creation, exhausting inodes or filesystem metadata and causing denial of service to the processing pipeline and any services sharing the same mount. Version 26.07.0 addresses this issue.

TypeBot versions prior to 3.17.0 contain an authorization bypass vulnerability allowing a low-privilege read collaborator to extract and overwrite OAuth credentials across workspaces. This flaw enables cross-workspace OAuth credential takeover by exploiting insufficient validation in the credential update process. The issue is patched in version 3.17.0.

CVE-2026-48762 is a Server-Side Request Forgery (SSRF) vulnerability in the TypeBot chatbot builder tool prior to version 3.16.0. The vulnerability occurs in the OpenAI "Create Transcription" action handler, which fetches a user-supplied audio URL without applying SSRF protections. This allows an attacker to make the server perform HTTP requests to arbitrary internal addresses, including localhost. The fetched content is then sent to the OpenAI Whisper API for transcription, and the result is returned to the attacker. Version 3.16.0 addresses this issue.

The Frontend Admin by DynamiApps WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 3.29.9. This flaw allows authenticated users with subscriber-level or higher permissions to reset any user's password, including administrators, potentially leading to full site compromise. Exploitation requires possession of a valid encrypted Current-User token, which can be used in a CBC bit-flipping attack to forge authorization. The vulnerability is classified as CWE-862 (Missing Authorization).