CVE-2026-111611 roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111611

The roncoo-education platform, through version 25.0.0-RELEASE , is affected by an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). This flaw exists in the pay cancel and continue endpoints, where the application fails to perform proper ownership validation. Authenticated users can...

CVE-2026-111605 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-111605

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-111605 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-85745

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header...

CVE-2026-49868

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

CVE-2026-49868

The RIOT open-source microcontroller operating system is vulnerable to an unbounded out-of-bounds (OOB) heap read due to a missing minimum-length validation in the _parse_reply() function within sys/net/application_layer/dhcpv6/client.c. If MODULE_DHCPV6_CLIENT_IA_PD is enabled, a malicious or co...

CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

EUVD-2026-102947

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

CVE-2026-49868

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

EUVD-2026-102942

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header...

CVE-2026-85745

The MariaDB server versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are vulnerable to an out-of-bounds read in the ST_Area function. The root cause is that the multi-polygon parser advances past a nested geometry header without verifying if sufficient input remains w...

CVE-2026-85745 MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header...

CVE-2026-85745

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header...

CVE-2026-85745

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header...

CVE-2026-85745 MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header...

CVE-2026-85745 MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header...