MariaDB: Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket

MariaDB Connector/J was found to have an unbounded result-set field-count allocation vulnerability. When parsing result-set responses, the driver read the column count directly from the wire and used it to size a Java array without validation. A malicious server was able to declare an extremely...

Weblate: **Unauthenticated IDOR allows modification of payment customer billing information**

The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because th...

MariaDB: MariaDB HandlerSocket Improper Request Field-Count Validation Causes Server Crash

A vulnerability was discovered in MariaDB Server's optional HandlerSocket plugin that allowed improper validation of request field-count parameters. When processing exec requests, the plugin allocated stack memory based on a client-supplied field count before validating whether the count was...

MariaDB: MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service

A low-privilege database user was able to exhaust memory on a MariaDB server through the SFORMAT function by specifying an extremely large width parameter. The function attempted to allocate nearly 2 GB of memory before generating the return value. Multiple concurrent requests caused the database...

HackerOne: IDOR allows user to access report details via reference.json endpoint

An information disclosure vulnerability was identified in a report details endpoint that allowed unauthorized users to access private report information. Despite the endpoint returning an access-denied error response, sensitive report details were inadvertently exposed in the error message body...

8x8: connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an...

8x8: connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs

An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation...

Node.js: Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected...

MariaDB: Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read

A critical remote code execution vulnerability was discovered in MariaDB Server 13.0.2. The vulnerability chained two memory-safety bugs to allow an authenticated low-privilege user to execute arbitrary operating system commands as the database process user without requiring FILE, SUPER, or...

Rocket.Chat: DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

Vulnerability description not provided...

MariaDB: #mysql50# legacy alias / internal table collisions

A vulnerability was discovered in MariaDB related to the legacy mysql50 table name prefix feature. The issue involved improper encoding of table names prefixed with mysql50, which allowed attackers to create tables that collided with internal reserved filenames used by the database system and...

MariaDB: #mysql50# legacy alias / stale table cache identity mismatch

A legacy compatibility mechanism for table name prefixes in MariaDB was exploited to cause a mismatch between the table definition cache and actual table metadata. By opening a table through one spelling and replacing it through an alternative alias, the cache was poisoned with stale metadata. Th...

MariaDB: DATA / INDEX DIRECTORY Abuse

A vulnerability was identified in the DATA DIRECTORY and INDEX DIRECTORY functionality of a database system. Users with ordinary schema-level privileges were able to write arbitrary data to attacker-chosen locations by exploiting path traversal issues in how external table directories were...

MariaDB: `SHOW [CREATE|GRANTS] ...` / `mariadb-dump` Unescaped SQL Generation

A vulnerability was discovered in the database server where multiple SHOW commands and a dump utility generated SQL output with unescaped values derived from stored metadata. This flaw could allow attacker-controlled data stored in database objects to be output as executable SQL statements. When ...

Node.js: HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion...

Essity: Unauthenticated Plugin Settings Modification on Three Crocoblock/Jet Plugins

The vulnerability summary is as follows: Three Crocoblock Jet plugins were found to expose REST API endpoints that allowed unauthenticated users to modify plugin settings via POST requests without any authentication or authorization checks. The endpoints validated and parsed the POST body, then...

Essity: 29 Premium Plugin Packages with License Keys Publicly Accessible in Uploads Directory

A summary of the vulnerability found is as follows: 29 premium plugin packages with license keys were publicly accessible in the uploads directory of the WordPress media library. The packages were downloadable without authentication and contained the full plugin source code and embedded...

Node.js: Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`

A flaw in Node.js Permission Model enforcement was discovered that allowed traceevents.createTracing.enable to write trace logs outside of the --allow-fs-write setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x...

8x8: JaaS SIP Gateway Authorization Bypass

The JaaS SIP gateway endpoint was validated without verifying the tenant's provisioned entitlements. This allowed tenants to place outbound SIP calls regardless of their subscription level. The issue was promptly addressed by implementing server-side entitlement checks to ensure proper...

MariaDB: Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write

A privilege enforcement vulnerability was discovered in file user-defined functions UDFs of a database engine. The file UDFs failed to enforce FILE privilege requirements and secure file path restrictions that were already implemented in the file-backed table handler. This allowed users with only...