NT OneAPP by NewType Infortech has a vulnerability (CVE-2026-114223) where sensitive information such as plaintext usernames and passwords can be extracted from backup data. This occurs when an unauthenticated local attacker obtains ADB backup access authorization and the user confirms the backup operation. The vulnerability is due to cleartext storage of sensitive information in backup data. It affects versions from 0 up to and including 1.5.22. The CVSS score is 6.7, indicating a medium severity risk.
NT OneAPP by NewType Infortech contains an authentication bypass vulnerability (CWE-287) that allows unauthenticated local attackers to bypass the app's PIN lock via a deep link, gaining access to protected resources of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 6.9, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
NT OneAPP by NewType Infortech has a credential disclosure vulnerability (CVE-2026-114221) where unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source within the WebView. This can lead to disclosure of the NUP Portal passcode of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 5.9, indicating a medium severity issue.
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.
CVE-2026-97712 is a high-severity vulnerability in Sonatype Nexus Repository 3 that allows users with create or update role permissions to grant themselves roles and privileges they do not originally possess. This flaw can escalate their access up to full administrative rights, potentially compromising the repository's security.
CVE-2026-97667 is a medium severity cross-site scripting (XSS) vulnerability in Sonatype Nexus Repository 3. It allows a user with edit permission on a hosted R repository to inject script content into the metadata of an uploaded R package. This script executes in the browser of any user who views the package details, running with the permissions of the viewing user. Both authenticated and anonymous users (if granted permission) can exploit this. The vulnerability affects versions from 3.28.0 up to but not including 3.97.0.
Sonatype Nexus Repository 3 contains a vulnerability where an unauthenticated remote attacker can supply attacker-controlled input to a Java class loading call via an ExtDirect endpoint. This allows the attacker to determine the presence of specific classes in the application but does not enable code execution by itself. The issue affects versions from 3.0.0 up to but not including 3.97.0. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.
CVE-2026-97665 is a high-severity vulnerability in Sonatype Nexus Repository 3 affecting the NuGet Components API upload path. It involves a missing authorization check that allows users with only read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing normal write-permission restrictions. This requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the anonymous user can exploit this without authentication due to default read and browse privileges.
The Favicon Rotator plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 1.2.11. This vulnerability arises from insufficient sanitization and escaping of 'fvrt_' prefixed request parameters, allowing unauthenticated attackers to inject arbitrary scripts. Successful exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser.
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.
Jawn is an open source JSON parser that prior to version 1.7.0 allowed parsing of JSON with arbitrarily deep nesting without limits. This could cause the parser to exhaust the JVM heap memory, resulting in a fatal OutOfMemoryError and denial of service. The issue is fixed in version 1.7.0.
Jawn is an open source JSON parser with a vulnerability in its AsyncParser component prior to version 1.7.0. The AsyncParser can perform quadratic work when processing a single JSON token delivered in many small chunks, leading to excessive CPU consumption. This can be exploited by a remote attacker controlling untrusted JSON input and chunk sizes to cause a denial of service. The issue is fixed in version 1.7.0.
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.
An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default.
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.