| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application's credentials. |
| ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file. |
| Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection |
| Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue. |
| A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs. |
| The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Exploitation requires that an administrator has configured at least one Ninja Forms field with its Default Value set to the {wp:user_display_name} merge tag on a publicly accessible page; a Subscriber need only set their display_name to a shortcode string via their profile and then visit that page. |
| An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue. |
| The Streamit WordPress theme before 4.5.2 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution. |
| A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs. |
| A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location. |
| A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.
For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546. |
| A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration. |
| In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks.
Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.
Required configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with "router ospf6" and on specific interfaces with "ipv6 ospf6 area".)
Workaround: either:
* configure OSPFv3 authentication trailers ("ipv6 ospf6 authentication")
* or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses. |
| A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised. |
| When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. |
| The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 14.14.0 - 14.14.7
Vaadin 23.6.0 - 23.6.16
Vaadin 24.4.0 - 24.4.25
Vaadin 24.5.0 - 24.5.15
Vaadin 24.6.0 - 24.6.13
Vaadin 24.7.0 - 24.7.16
Vaadin 24.8.0 - 24.8.17
Vaadin 24.9.0 - 24.9.23
Vaadin 24.10.0 - 24.10.11
Vaadin 25.0.0 - 25.0.13
Vaadin 25.1.0 - 25.1.13
Vaadin 25.2.0 - 25.2.10
Vaadin 25.3.0 - 25.3.2
Vaadin Framework 7.1.0 - 7.7.54
Vaadin Framework 8.0.0 - 8.32.1
Mitigation
Upgrade to 14.14.8
Upgrade to 23.6.17
Upgrade to 24.4.26
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.9.24
Upgrade to 24.9.24
Upgrade to 24.10.12
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.3.3
Upgrade to 7.7.55
Upgrade to 8.32.2
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Artifacts under com.vaadin
Maven coordinates / Vulnerable versions / Fixed version
vaadin / 14.14.0 - 14.14.7 / >=14.14.8
vaadin / 23.6.0 - 23.6.16 / >=23.6.17
vaadin / 24.4.0 - 24.4.25 / >=24.4.26
vaadin / 24.5.0 - 24.5.15 / >=24.7.17
vaadin / 24.6.0 - 24.6.13 / >=24.7.17
vaadin / 24.7.0 - 24.7.16 / >=24.7.17
vaadin / 24.8.0 - 24.8.17 / >=24.9.24
vaadin / 24.9.0 - 24.9.23 / >=24.9.24
vaadin / 24.10.0 - 24.10.11 / >=24.10.12
vaadin / 25.0.0 - 25.0.13 / >=25.2.11
vaadin / 25.1.0 - 25.1.13 / >=25.2.11
vaadin / 25.2.0 - 25.2.10 / >=25.2.11
vaadin / 25.3.0 - 25.3.2 / >=25.3.3
vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8
vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17
vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26
vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17
vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17
vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17
vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24
vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24
vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12
vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11
vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11
vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11
vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3
flow-server / 2.13.0 - 2.13.7 / >=2.13.8
flow-server / 23.6.0 - 23.6.15 / >=23.6.16
flow-server / 24.4.0 - 24.4.18 / >=24.4.19
flow-server / 24.5.0 - 24.5.17 / >=24.7.17
flow-server / 24.6.0 - 24.6.14 / >=24.7.17
flow-server / 24.7.0 - 24.7.15 / >=24.7.16
flow-server / 24.8.0 - 24.8.16 / >=24.9.24
flow-server / 24.9.0 - 24.9.28 / >=24.9.29
flow-server / 24.10.0 - 24.10.14 / >=24.10.15
flow-server / 25.0.0 - 25.0.15 / >=25.2.11
flow-server / 25.1.0 - 25.1.18 / >=25.1.19
flow-server / 25.2.0 - 25.2.12 / >=25.2.13
flow-server / 25.3.0 - 25.3.3 / >=25.3.4
vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55
vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2
vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55
vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2 |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges. |
| An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution. |
