Threat database

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges.

Openwave Webtop Media Transcoder versions before 1.1.22.0 do not enforce administrator-defined file type restrictions for file conversions. This allows authenticated users to convert file types beyond those intended by administrators, potentially leading to unintended processing of documents. The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact confidentiality or integrity but may affect availability.

CVE-2026-16438 is an incorrect privilege assignment vulnerability affecting Mitsubishi Electric GENESIS64 and related products up to version 10.97.3, as well as all versions of MC Works64. The issue arises because installers grant default DCOM permissions to administrator accounts unnecessarily, allowing those accounts to launch and operate DCOM objects locally or remotely without required UAC elevation. This can lead to unauthorized disclosure, tampering, destruction, or deletion of internal information, or cause denial-of-service conditions.

CVE-2026-16437 is a high-severity vulnerability in Mitsubishi Electric Corporation GENESIS and related products. It involves a weak password recovery mechanism that allows an authenticated local administrator to tamper with the management file storing the challenge response. This file is protected by Windows, but administrators can read and write it, enabling potential disclosure, tampering, destruction, or deletion of internal information, or causing a denial-of-service condition. The vulnerability affects multiple GENESIS product versions and related software. A patch is available to address this issue.

CVE-2026-16436 is a critical vulnerability in Mitsubishi Electric Corporation's GENESIS and related products involving a weak password recovery mechanism. The challenge response used to unlock the system is fixed and common to all users, allowing a remote attacker to bypass authentication. This vulnerability affects multiple versions of GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. Exploitation could lead to unauthorized disclosure, tampering, destruction, or deletion of internal information, or cause a denial-of-service condition. A patch is available, and the affected products are cloud services with vendor-managed remediation.

Raven versions 2.0.0 through 3.0.0 have a missing authorization vulnerability that allows authenticated users with the Raven User role to bypass the can_only_join_via_invite setting. This enables them to join invite-only Public workspaces without an invitation, gaining persistent membership and the ability to read and post in Public and Open channels.

Raven versions 2.0.0 through 3.0.0 have a missing authorization vulnerability in legacy API methods that bypass workspace membership checks. This allows authenticated users who are not members of a workspace to access public channel history and file metadata by using predictable channel IDs. The vulnerability affects the methods get_messages_with_dates and get_all_files_shared_in_channel.

CVE-2026-62118 is a high-severity vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. It involves missing authorization controls, allowing unauthenticated users to bypass access restrictions. This flaw can lead to unauthorized information disclosure, modification, and availability impact.

CVE-2026-62117 is a high severity SQL Injection vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager affecting versions up to and including 1.13.1. The flaw allows improper neutralization of special elements in SQL commands, potentially enabling an attacker with low privileges to execute unauthorized database queries. This vulnerability impacts confidentiality and availability but does not affect integrity. No patch or remediation information is currently provided.

CVE-2026-62116 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication, potentially impacting confidentiality, integrity, and availability.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.

MIT Kerberos 5 (krb5) versions up to 1.22.2 contain a NULL pointer dereference vulnerability in the make_cred_list() function within rd_cred.c. This flaw allows authenticated Kerberos clients to cause a denial of service by crashing services that accept GSS-API security contexts. The issue arises when attackers send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context(), leading to a service crash.

MIT krb5 versions up to 1.22.2 have a NULL pointer dereference vulnerability in the KDC component's get_pac_princ_with_realm() function. This flaw occurs when processing malformed client names in S4U2Proxy requests from a malicious or compromised cross-realm trusted KDC, potentially causing the krb5kdc service to crash and deny authentication.

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.