CVE-2026-110475 is a critical vulnerability in the CreditNirvana Collections Platform (CollectionWorkz) caused by weak authentication and authorization controls in the platform login service. An unauthenticated remote attacker can exploit this flaw to manipulate authentication requests and access APIs without a valid session. This allows the attacker to enumerate users, impersonate arbitrary users including administrators, and access or modify sensitive data with the privileges of the impersonated user.
CVE-2026-110474 is a vulnerability in the CreditNirvana Agentic AI Call Centre application caused by a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. Using the extracted key, the attacker can make arbitrary API calls to access sensitive call transcripts and recordings through the application API.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal.
This issue affects Logsign SIEM: from 6.4.120 before 6.4.122.
CVE-2026-116228 is a medium-severity vulnerability in 777genius agent-teams-ai up to version 2.17.10. It involves missing authentication in the Local HTTP Service component, specifically in the doStart function of src/main/services/infrastructure/HttpServer.ts. Exploitation requires local access. Public exploit code exists, but no vendor response or patch has been provided.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
Parse Server versions before 8.6.101 and versions from 9.0.0 up to but excluding 9.10.4-alpha.4 contain a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to send REST API delete requests to the internal _SCHEMA collection, enabling deletion of stored schema elements such as field definitions, class-level permissions, and protected fields. This unauthorized deletion can expose data to unauthorized reads and modifications.
CVE-2026-116164 is a vulnerability in parse-community's parse-server that affects versions before 8.6.100 and 9.0.0 before 9.10.4-alpha.3. It allows clients to write or clear reserved internal fields in objects due to improper input validation. This can cause read failures on MongoDB queries for all users or enable attackers to bypass account lockout and password policies by clearing their own lockout state and password history.
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
Parse Server versions before 8.6.104 and versions from 9.0.0 up to but not including 9.10.5-alpha.5 have an improper privilege management vulnerability. When issuing an SMS multi-factor authentication verification code, the server saves the entire login request with master privileges. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 have an information disclosure vulnerability in the LiveQuery feature. The vulnerability arises because the subscription hash does not include constraints adjacent to a $or operator, such as the _Session owner filter and beforeSubscribe constraints. This causes distinct subscriptions to be grouped together, allowing authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
CVE-2026-116044 is a medium severity vulnerability in prasathmani TinyFileManager up to version 2.6. It involves an unrestricted file upload flaw in the Remote URL File Upload Module within tinyfilemanager.php. This vulnerability allows remote attackers to upload files without proper restrictions. The vendor was contacted but did not respond, and public exploit details have been disclosed.
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
CVE-2026-115995 is a critical OS command injection vulnerability in Unitree Robotics Unitree Go2 versions 1.1.11.0 through 1.1.11.4. The flaw exists in the set_volume function within the gpt_thread.py file of the chat_go component. This vulnerability allows remote attackers to execute arbitrary OS commands by manipulating the argument Value. The issue is resolved by upgrading to version 1.1.11.5.