CVE-2026-62856 FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...

CVE-2026-62856 FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...

CVE-2026-62856

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...

CVE-2026-62856

The help desk and shared mailbox application FreeScout is vulnerable to cross-user notification data disclosure in versions prior to 1.8.226 . The polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while authorization checks are only applied to names with spec...

CVE-2026-111753

A flaw was found in @angular/common. Due to discrepancies between internal URL validation and browser URL parsing standards, outgoing requests to external destinations can be misclassified as same-origin requests. A remote attacker who induces an application to send a request to an...

CVE-2026-122151

A flaw was found in Presenton. Due to improper request handling in the user configuration component, a remote attacker can trick an authenticated user into submitting an unauthorized request. This Cross-Site Request Forgery CSRF vulnerability allows an attacker to alter the victim's configuration...

CVE-2026-84178

A flaw was found in Apache Camel's OAuth component. The authorization code callback endpoint fails to verify a state parameter binding the authorization request to the user's session. A remote attacker can exploit this vulnerability to perform a login Cross-Site Request Forgery CSRF attack,...

CVE-2026-118266

A flaw was found in Echo. This vulnerability allows a remote attacker to bypass Cross-Site Request Forgery CSRF protections when the MethodOverride middleware is positioned before CSRF validation in the request chain. By tricking an authenticated user into submitting a crafted request that rewrit...

CVE-2026-113796

A flaw was found in Electron. When opening links into a new window, Electron incorrectly classifies navigations as application-initiated rather than preserving the originating page as the initiator. A remote attacker who convinces an application to load untrusted web content that opens new window...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-84228 DESCRIPTION: IBM Guardium Data Protection could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. CWE:CWE-20:...

CVE-2026-92704

A flaw was found in SharpEmu's debugger frontend. The local debugger interface lacks authentication and Cross-Site Request Forgery CSRF protections. A remote attacker could exploit this by tricking a user into visiting a malicious website that transmits unauthorized requests to the local service...

CVE-2026-103938

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patientfile/poscheckoutippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The formchecksum...

CVE-2026-103939

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-104135

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

CVE-2026-103939

Prior to version 8.3.0 , OpenEMR is vulnerable due to a lack of ACL and CSRF checks in the interface/modules/custom_modules/oe-module-weno/scripts/file_download.php script. When the Weno module is enabled, the default GET path triggers PharmacyService::removeWenoPharmacies(), which can be execute...

EUVD-2026-117774

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-103939 OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-103939 OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

EUVD-2026-117769

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

CVE-2026-103938 OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patientfile/poscheckoutippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The formchecksum...