Automattic Sensei LMS Authorization Issue Vulnerability

Automattic Sensei LMS versions prior to 4.26.4 have an authorization issue vulnerability. This vulnerability stems from improper access control in the AJAX handler for addnewmoduleterm. Only a generic nonce is verified, and only checks are performed for slug prefixes in manageoptions, without...

IBM MQ Operator deserialization injection vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 pre-versions, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, and 4.0.0 through 4.0.4 have a deserialization injection vulnerability. This vulnerabilit...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework, versions 2.0.0 to 3.14.4, has a resource management vulnerability. This vulnerability stems from the handling of multipart requests, which retains an unlimited number of open file descriptors. When the processing program uses Request.post,...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Krayin Laravel-CRM: Server-side request forgeing vulnerability

In versions prior to 2.2.7 of krayin Laravel-CRM, there was a server-side request forgeing vulnerability. This vulnerability stemmed from an SSRF filter, allowing users with webhook permissions to access internal addresses through DNS rebinding. Attackers could return public addresses during the...

WSO2 API Control Plane session mechanism vulnerability

WSO2 API Control Plane versions prior to 4.5.0 and 4.6.0 and 4.6.0 and 4.6.0.13 contained a session mechanism vulnerability. This vulnerability stemmed from the use of the session binding token feature and token binding verification, but without enabling the “Revoke tokens upon user logout” optio...

Apache Camel code injection vulnerability

Apache Camel versions from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain security vulnerabilities. These vulnerabilities stem from the Camel HTTP producer, which allows inbound messages to override endpoint URIs through the CamelHttpUri and CamelRestHttpUri headers. It also parses property...

Apache Camel path traversal vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a path traversal vulnerability. This vulnerability arises due to the Azure Files component failing to normalize the construction of absolute paths by concatenating configuration directories with lists of server...

Apache Camel session mechanism vulnerabilities

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to the session mechanism. This vulnerability arises because the Thrift component deserializes incoming data into the shared defaultInstance rather than into a new copy, resulting in data leakag...

Apache Camel race condition vulnerabilities

In Apache Camel versions 4.12.0 to 4.18.5 and 4.19.0 to 4.22.1, there is a race condition vulnerability. This issue arises due to the shared java.security.Signature instance in the PQC component being accessed asynchronously. Since this instance is not thread-safe, concurrent interactions between...

Apache Camel encryption issue vulnerabilities

Versions of Apache Camel from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a security vulnerability related to encryption. This vulnerability arises when the Knative HTTP client enables SSL but does not configure a truststore. In such cases, the client options revert to trusti...

Nexcess Event Tickets Authorization Vulnerability

Nexcess Event Tickets versions 5.30.1 and earlier have an authorization issue vulnerability. This vulnerability stems from unauthorized authorization through user-controlled keys. Improper configuration of access control levels may lead to exploitation of these vulnerabilities...

Priyanshu Raj cli-bridge post-link vulnerability

Priyanshu Raj’s cli-bridge versions prior to 0.0.2 have a postfix link vulnerability. This vulnerability arises when fs.realpathSync throws an ENOENT error when there is no target available. In such cases, symbolic links pointing outside the working directory’s root directory bypass the...

FossBilling authorization issue vulnerability

FossBilling versions from 0.8.4 to 0.8.6 had an authorization issue. This vulnerability stemmed from the use of hasManagePermission, which incorrectly allowed access to inactive non-core modules. This caused the system to bypass module access checks and manageSettings inspections, allowing...

WSO2 API Manager authorization issue vulnerability

WSO2 API Manager versions prior to 3.2.0.4.34, 3.2.1.54, 4.1.0.218, 4.2.0.156, 4.3.0.67, 4.4.0.30, and 4.5.0.14; WSO2 Universal Gateway versions prior to 4.5.0.14; WSO2 API Control Plane versions prior to 4.5.0.15; and Forgerock Key Manager Component versions prior to 1.0.0.4, 1.1.0.2, and 1.1.5....

Google Agent Mesh Authorization Vulnerability

The Google Agent Mesh version 0.1.0-alpha.1 to 0.1.0-alpha.2 contains an authorization vulnerability. This vulnerability stems from the lack of key functionality for authentication and authorization in the/libp2p-http entry server. Biscuit tokens or grid registrations are not verified, resulting ...

Mindee docTR deserialization injection vulnerability

Mindee docTR 1.1.0 and earlier versions have a deserialization injection vulnerability. This vulnerability stems from the use of torch.load to load checkpoints in loadpretrainedparams, where weightsonly=True is not set. This allows attackers to inject malicious pickle payloads by controlling loca...

LlamaFamily: Llama Chinese Community: Input validation error vulnerability

The LlamaFamily Llama Chinese community has a security vulnerability. This vulnerability stems from an error in the function getclassfromdynamicmodule in the Adapter Config component’s examples/chatgradionomerge.py file, where the parameter basemodelnameorpath is handled incorrectly, potentially...

ztxz16 fastllm buffer error vulnerability

The ztxz16 fastllm 0.1.8.2 and earlier versions have a buffer overflow vulnerability. This vulnerability stems from the improper handling of the parameter len in the GGUFBuffer::ReadString function found in the file thirdparty/gguf/gguf.cpp. This allows an attacker to launch a remote attack...

Fenrir Sleipnir Mobile for Android: Processing logic error vulnerability

Fenrir Sleipnir Mobile for Android versions prior to 3.9.0 has a processing logic vulnerability. This vulnerability stems from an UI deception issue. A remote attacker can enter full-screen mode through the Fullscreen API without displaying any persistent notifications or indications of trusted...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0 through 3.9.2, and 4.0.0 through 4.0.4 have a buffer error vulnerability. This...

IBM MQ Operator numerical error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0 through 3.8.1, 3.9.0 through 3.9.2, and 4.0.0 through 4.0.4 contain a numerical error...

.NET Platform AdventureWorks Authorization Issue Vulnerability

The .NET Platform AdventureWorks has an authorization issue vulnerability. This vulnerability stems from an improper authentication mechanism in the AddApplicationServices function within the Catalog API component’s file src/Catalog.API/Extensions/Extensions.cs. This could allow remote attackers ...

Alex MeTube Server Request Forgery Vulnerability

Alex MeTube’s versions as of September 28, 2026, have a server-side request forgeing vulnerability. This vulnerability stems from improper handling of the DownloadQueue.writefeedmetadatasync function in the Feed-metadata Thumbnail Fetch Handler component. It may lead to server-side request forger...

Itsourcecode Online Cake Ordering System: Input validation error vulnerability

The Itsourcecode Online Cake Ordering System 1.0 version has a security vulnerability. This vulnerability stems from incorrect handling of the cancel parameter in the confirm.php file, which may lead to SQL injection attacks...

MLJAR mercury: Vulnerability due to improper output processing

The MLJAR Mercury version 3.0.0 to 3.2.11 had a security vulnerability. This vulnerability stemmed from mr.Markdown not cleaning up the original HTML when converting it into HTML, and then assigning that HTML to the ipyWidgets.HTML receiver. This could lead to cross-site scripting attacks. Active...

PT Norther Lights Production Map – SVG file upload vulnerability

PT Norther Lights Production Map: Versions prior to SVG 8.16.1 have an arbitrary file upload vulnerability. This vulnerability stems from allowing the upload of dangerous types of files, which may lead to the uploading of a Web Shell to the web server...

Frappe CRM authorization issue vulnerability

Frappe CRM versions prior to 1.81.2 have an authorization issue vulnerability. This vulnerability stems from the lack of a permission hook, resulting in insufficient authorization checks. Certified Sales users can access the CRM notification records of other users. Attackers can query the...

Frappe CRM authorization issue vulnerability

Frappe CRM versions prior to 1.74.0 have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification. Identified Sales Users can modify other users’ call records by providing any valid callsid value. They can also call upon the addnotetocalllog and...

aircheng-org iWebShop Cross-Site Request Forgery Vulnerability

aircheng-org iWebShop versions 5 and earlier have a security vulnerability. This vulnerability stems from incorrect handling of parameters "password" and "repassword" in the "adminrepwd/adminrepwdact" function in the "Password Change" component. This could lead to cross-site request forgery...

Chamilo LMS cross-site scripting vulnerabilities

Chamilo LMS versions 1.11.40 and earlier, 2.0.3 and earlier, as well as 3.0.1 and earlier, have a security vulnerability. This vulnerability stems from the incorrect handling of the parameter Name in the TicketManager::addProject function within the main/inc/lib/TicketManager.php file in the Tick...

Artifex MuPDF buffer error vulnerability

Artifex MuPDF versions 1.28.5 and earlier have a security vulnerability. This vulnerability stems from the freecharlist function in the Signature Locking component, where there is a double release of resources, which may lead to remote attacks...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability arises due to XPathBuilder bypassing the default document type when documentType is set to InputSource. As a result, XML external entity reference...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper handling of HTTP header name case sensitivity. The protection mechanism that prevents request headers from being reflected in...

Apache Camel permission and access control vulnerabilities

Versions of Apache Camel from 4.12.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain vulnerabilities related to permission management and access control. These vulnerabilities arise from the PQC component writing key material to the disk with process default umask permissions, without restricting...

Apache Camel information leakage vulnerability

Apache Camel HTTP versions from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the followRedirects=true parameter is used, and the OAuth2ClientConfigurer interceptor intercepts and matches AuthScope f...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper input validation in the Apache Camel Mail component. In the MimeMultipart data format, filters are not applied to the mail.smt...

Apache Camel configuration error vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a configuration error vulnerability. This vulnerability stems from the enableCORS function of the Jetty component using the default CrossOriginFilter configuration, which accepts requests from any origin and allows...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation. This vulnerability arises when the FopProducer creates a TransformerFactory by enabling only FEATURESECUREPROCESSING, without restricting access to external resources...

IBM Concert information leakage vulnerability

The IBM Concert versions 1.0 to 3.0.0 have a vulnerability related to information leakage. This vulnerability arises from the fact that web page caches are stored locally, making them potentially readable by other users on the system, thereby leading to information leakage...

Progressive Robot hMailServer: Permissions, licensing, and access control issues

The Progressive Robot hMailServer version 6.0.0 to 6.3.6 has vulnerabilities related to permission and access control. These vulnerabilities stem from improper default permission settings of the Windows installer. The installer accepts files from any path, and the program folder and Bin directory...

Koozali SME Server has a vulnerability related to input validation errors.

The Koozali SME Server version 11.0rc1-215 has a security vulnerability. This vulnerability stems from the domain creation feature, which allows high-privilege attackers to inject reserved Apache configuration directives, damaging the httpd.conf file. As a result, Apache cannot be started after t...

IBM MQ Operator race condition vulnerability

IBM MQ Operator 2.0.29 and earlier versions of 2.0.x, 3.2.29 and earlier versions of 3.2.x, versions 3.3.0 to 3.4.0, 3.4.1, 3.5.0, 3.5.1 to 3.5.3, 3.6.0 to 3.6.4, 3.7.0 to 3.7.2, 3.8.0, 3.8.1, 3.9.0 to 3.9.2, and 4.0.0 to 4.0.4 have a race condition vulnerability. This vulnerability stems from...

Camunda 7 command injection vulnerability

Camunda 7 versions from 7.24.0 to 7.24.14, as well as versions from 7.23.0 to 7.23.17, have security vulnerabilities. These vulnerabilities stem from a flaw in AdhocQueryValidator.validate, which fails to check the subquery expression mappings exposed in the orQueries field of TaskQueryDto. This...

CognicellAI Cognition configuration error vulnerability

CognicellAI Cognition versions prior to 0.13.0 have a security vulnerability. This vulnerability stems from the default setting of having the agent sandbox backend executed locally, and the REST/SSE API not enabling authentication. Attackers can create sessions using the POST /sessions endpoint...

ThimPress LearnPress licensing issue vulnerabilities

ThimPress and LearnPress versions 4.4.10 and earlier have an authorization-related vulnerability. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

WSO2 Identity Server side-channel information leakage vulnerability

WSO2 Identity Server versions prior to 7.0.0.134 and 7.1.0.42, WSO2 Carbon Abstract OTP Authenticator versions prior to 1.0.10.2, as well as Email OTP Authenticator versions prior to 1.0.30.5, have a side-channel information leakage vulnerability. This vulnerability arises from the authentication...

GPAC security vulnerabilities

The GPAC component has a security vulnerability. This vulnerability stems from the reuse of a heap object after its release by the gfodfac4cfgcleanlist function /odf/descriptors.c. This could allow attackers to cause a denial-of-service attack by providing a specially crafted AC4 file...

Mopidy path traversal vulnerability

Mopidy versions prior to 4.0.5 have a path traversal vulnerability. This vulnerability stems from the lack of inclusion checks in the FileLibraryProvider.lookup function. As a result, unauthenticated attackers can use JSON-RPC or WebSocket to call core.library.lookup or core.tracklist.add, thereb...

ays-pro Quiz Maker by AYS – Cross-site Scripting Vulnerabilities

The ays-pro Quiz Maker versions 6.7.1.91 and earlier have a cross-site scripting vulnerability. This vulnerability arises from improper input during web page generation, and it may lead to reflection-type cross-site scripting attacks...