Liberapay: Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat

A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as...

MariaDB: MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover

A vulnerability was discovered in MariaDB that allowed an authenticated user with only USAGE privileges to change the password of an existing administrator account. This was achieved through the grantee clause of the GRANT PROXY statement, which permitted bypassing the authorization checks and...

Weblate: Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command execution

A vulnerability was discovered in Weblate, a web-based translation tool. The vulnerability was caused by an incomplete fix for a previous issue CVE-2022-23915. Weblate passed repository-controlled filenames to Mercurial without properly escaping them, allowing filenames beginning with "-" to be...

Essity: Unauthenticated SQL Injection via REST Batch Route Confusion ████████

A vulnerability was discovered in the WordPress REST API batch endpoint /wp-json/batch/v1 on a certain website. The vulnerability allowed unauthenticated blind SQL injection by nesting a crafted batch payload, which triggered a route-dispatch desynchronization. This caused a user-controlled strin...

Rocket.Chat: Stored HTML Injection (CWE-79) via Livechat Visitor Name

Vulnerability description not provided...

Weblate: **Unauthenticated IDOR allows modification of payment customer billing information**

The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because th...

8x8: connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an...

8x8: connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs

An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation...

Node.js: Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected...

Rocket.Chat: DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

Vulnerability description not provided...

Node.js: HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion...

Essity: Unauthenticated Plugin Settings Modification on Three Crocoblock/Jet Plugins

The vulnerability summary is as follows: Three Crocoblock Jet plugins were found to expose REST API endpoints that allowed unauthenticated users to modify plugin settings via POST requests without any authentication or authorization checks. The endpoints validated and parsed the POST body, then...

Essity: 29 Premium Plugin Packages with License Keys Publicly Accessible in Uploads Directory

A summary of the vulnerability found is as follows: 29 premium plugin packages with license keys were publicly accessible in the uploads directory of the WordPress media library. The packages were downloadable without authentication and contained the full plugin source code and embedded...

Node.js: Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`

A flaw in Node.js Permission Model enforcement was discovered that allowed traceevents.createTracing.enable to write trace logs outside of the --allow-fs-write setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x...

8x8: JaaS SIP Gateway Authorization Bypass

The JaaS SIP gateway endpoint was validated without verifying the tenant's provisioned entitlements. This allowed tenants to place outbound SIP calls regardless of their subscription level. The issue was promptly addressed by implementing server-side entitlement checks to ensure proper...

Node.js: Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

A flaw was discovered in the Node.js HTTP/2 implementation that allowed the nghttp2sessionmemsend function to be called re-entrantly while nghttp2sessionmemrecv was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x...

curl: heap-use-after-free in curl_easy_cleanup() called from callback

Summary: Curlclose lib/url.c:214 calls curlmultiremovehandledata-multi, data and ignores the return value. When curleasycleanup is invoked from within a write/read/progress/header callback, multi-incallback is TRUE, so curlmultiremovehandle lib/multi.c:818-819 returns CURLMRECURSIVEAPICALL withou...

curl: libcurl upload read callbacks miss recursive API guard, allowing prohibited multi API reentry and ASAN-confirmed UAF

Summary: Several libcurl upload read callback paths invoke the application-provided CURLOPTREADFUNCTION without marking the easy handle as being inside a callback. As a result, recursive multi APIs that are correctly rejected from ordinary callbacks are accepted from these upload read callback...

curl: setopt(VERIFYPEER) from callback bypasses TLS verify on connection reuse

Summary: Curlsslconnconfigupdate overwrites conn-sslconfig.verifypeer when curleasysetoptCURLOPTSSLVERIFYPEER, ... is called, with no handshake-state guard — only ifdata-conn. Since setopt is documented as callable from callbacks setopt.c:2930, an application can connect with verifypeer=0 accepti...

curl: CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer

Summary CURLSHOPTUNSHARE can free a shared SSL session cache while another thread is starting a normal HTTPS transfer with the same share handle. The failing transfer reaches the cache through curleasyperform, during the OpenSSL handshake. libcurl appears to try to reject this kind of lifetime...