| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. |
| A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs. |
| A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim. |
| A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location. |
| A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.
For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546. |
| A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration. |
| A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks.
Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.
Required configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with "router ospf6" and on specific interfaces with "ipv6 ospf6 area".)
Workaround: either:
* configure OSPFv3 authentication trailers ("ipv6 ospf6 authentication")
* or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses. |
| A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised. |
| When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. |
| The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 14.14.0 - 14.14.7
Vaadin 23.6.0 - 23.6.16
Vaadin 24.4.0 - 24.4.25
Vaadin 24.5.0 - 24.5.15
Vaadin 24.6.0 - 24.6.13
Vaadin 24.7.0 - 24.7.16
Vaadin 24.8.0 - 24.8.17
Vaadin 24.9.0 - 24.9.23
Vaadin 24.10.0 - 24.10.11
Vaadin 25.0.0 - 25.0.13
Vaadin 25.1.0 - 25.1.13
Vaadin 25.2.0 - 25.2.10
Vaadin 25.3.0 - 25.3.2
Vaadin Framework 7.1.0 - 7.7.54
Vaadin Framework 8.0.0 - 8.32.1
Mitigation
Upgrade to 14.14.8
Upgrade to 23.6.17
Upgrade to 24.4.26
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.9.24
Upgrade to 24.9.24
Upgrade to 24.10.12
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.3.3
Upgrade to 7.7.55
Upgrade to 8.32.2
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Artifacts under com.vaadin
Maven coordinates / Vulnerable versions / Fixed version
vaadin / 14.14.0 - 14.14.7 / >=14.14.8
vaadin / 23.6.0 - 23.6.16 / >=23.6.17
vaadin / 24.4.0 - 24.4.25 / >=24.4.26
vaadin / 24.5.0 - 24.5.15 / >=24.7.17
vaadin / 24.6.0 - 24.6.13 / >=24.7.17
vaadin / 24.7.0 - 24.7.16 / >=24.7.17
vaadin / 24.8.0 - 24.8.17 / >=24.9.24
vaadin / 24.9.0 - 24.9.23 / >=24.9.24
vaadin / 24.10.0 - 24.10.11 / >=24.10.12
vaadin / 25.0.0 - 25.0.13 / >=25.2.11
vaadin / 25.1.0 - 25.1.13 / >=25.2.11
vaadin / 25.2.0 - 25.2.10 / >=25.2.11
vaadin / 25.3.0 - 25.3.2 / >=25.3.3
vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8
vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17
vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26
vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17
vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17
vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17
vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24
vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24
vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12
vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11
vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11
vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11
vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3
flow-server / 2.13.0 - 2.13.7 / >=2.13.8
flow-server / 23.6.0 - 23.6.15 / >=23.6.16
flow-server / 24.4.0 - 24.4.18 / >=24.4.19
flow-server / 24.5.0 - 24.5.17 / >=24.7.17
flow-server / 24.6.0 - 24.6.14 / >=24.7.17
flow-server / 24.7.0 - 24.7.15 / >=24.7.16
flow-server / 24.8.0 - 24.8.16 / >=24.9.24
flow-server / 24.9.0 - 24.9.28 / >=24.9.29
flow-server / 24.10.0 - 24.10.14 / >=24.10.15
flow-server / 25.0.0 - 25.0.15 / >=25.2.11
flow-server / 25.1.0 - 25.1.18 / >=25.1.19
flow-server / 25.2.0 - 25.2.12 / >=25.2.13
flow-server / 25.3.0 - 25.3.3 / >=25.3.4
vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55
vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2
vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55
vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2 |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges. |
| The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them. |
| A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality. |
| An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution. |
| CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112. |
| Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3. |
| The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. |
| Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0. |
