CVE-2026-79868 Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or...

CVE-2026-79868

Technical details regarding CVE-2026-79868 are not publicly available in the provided documents. While the title suggests Authentication Bypass Vulnerabilities leading to Complete System Compromise in AOS-8 , the description contains no concrete technical details. Monitor for updates.

CVE-2026-79856 Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8

A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or...

CVE-2026-79856

CVE-2026-79856 involves an unauthenticated buffer overflow vulnerability in AOS-8 that leads to an authentication bypass . While the provided documents do not specify the exact component or version affected, the vulnerability is assigned a CRITICAL CVSS 3.1 score of 9.8. Details regarding the roo...

CVE-2026-79856 Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8

A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via insufficient isolation of verification records across different authentication flows. Because magic-link tokens and OAuth state...

CVE-2026-113874

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

CVE-2026-108358

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

CVE-2026-108357

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub

Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security issue if the IP address of the attacked executor is know and...

CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub

Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security issue if the IP address of the attacked executor is know and...

EUVD-2026-108278

Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security issue if the IP address of the attacked executor is know and...

CVE-2026-115517

Versions of KNIME Business Hub prior to 1.19.0 are vulnerable to unrestricted network access between execution contexts. An authenticated remote user can access open network ports on executors in different execution contexts. This vulnerability poses a security risk only if the target executor's ...

CVE-2026-114612

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted...

CVE-2026-113874

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

EUVD-2026-108274

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

CVE-2026-113874 SmileCDR HAPI FHIR trusted tenant partition override

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

CVE-2026-113874

The SmileCDR HAPI FHIR component is vulnerable to a partition identity override because it allows an untrusted bundle body to replace a partition identity previously established by a trusted source. Due to a lack of default storage partition entitlement enforcement, an attacker authorized for one...

CVE-2026-108357

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-108358

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...