What needs attention now.

Icinga 2: Improper access control for JSON-RPC update certificate messages

• icinga2
• Broken access control

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

• Weak cryptography or TLS

<4.14.2 · fixed in 4.14.2

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

• Authentication bypass
• CWE-302

<0.31.4 || >=0.32.0, <0.32.2 · fixed in 0.31.4, 0.32.2

Data deletion and attribute disclosure via field-name method injection in in-memory queries

• MongoDB Inc. Mongoid
• Code injection

Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path

• ultravioletrs cocos
• CWE-346
• CWE-354

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

• Insecure deserialization

>=0.9.2, <0.16.0 · fixed in 0.16.0

Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path

• ultravioletrs cocos
• CWE-346

WACRM: Database-layer authorization bypasses

• ArnasDon wacrm
• Broken access control

CareCam CM2507 Cleartext Storage of Sensitive Information

• CareCam HMT.CM2507 Firmware
• Information disclosure

CareCam CM2507 Use of Password Hash With Insufficient Computational Effort

• CareCam HMT.CM2507 Firmware
• Weak cryptography or TLS

IBM MQ for HPE NonStop is vulnerable to a denial of service attack

• IBM MQ for HPE NonStop
• Memory corruption

libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items

• strukturag libheif
• Memory corruption

IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing

• IBM MQ Appliance
• Memory corruption

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

• IBM Common Licensing
• Cross-site request forgery (CSRF)

Code injection in Interchange

• Interchange
• Code injection

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

• Code injection

<14.10.2 · fixed in 14.10.2

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read

• Denial of service
• CWE-196

vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

• patriksimek vm2
• CWE-693

vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

• patriksimek vm2
• Code injection

Missing Length Check

• ABB Freelance Controller DCP
• ABB Freelance Controller AC700
• CWE-130

Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell

• Cohesity NetBackup Flex OS
• Weak cryptography or TLS

Privilege Escalation via Argument Injection in NetBackup Flex OS Shell

• Cohesity NetBackup Flex OS
• Command injection

Synology DiskStation Manager (DSM): An insufficient entropy vulnerability in login logic in Synology DiskStation Manager…

• Synology DiskStation Manager (DSM)
• CWE-331

Improper output encoding in Synology DiskStation Manager (DSM)

• Synology DiskStation Manager (DSM)
• CWE-116

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• SQL injection
• Information disclosure

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• Server-side request forgery (SSRF)

AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

• AF Companion
• Code injection

HGiga｜OAKlouds - Insecure Deserialization

• HGiga OAKlouds-custom_page-2.0
• HGiga OAKlouds-custom_page-3.0
• Insecure deserialization

Microsoft Fabric Elevation of Privilege Vulnerability

• Microsoft Fabric
• Authentication bypass

Azure Database for PostgreSQL Elevation of Privilege Vulnerability

• Microsoft Azure HorizonDB
• Broken access control

Azure Billing Elevation of Privilege Vulnerability

• Microsoft Azure Billing
• CWE-345

Incorrect default permissions in Acronis Backup plugin for cPanel & WHM and others

• Acronis Backup plugin for cPanel & WHM
• Acronis Backup extension for Plesk
• Broken access control

Azure AI Foundry Elevation of Privilege Vulnerability

• Microsoft Azure AI Foundry
• Authentication bypass

Azure Logic Apps Elevation of Privilege Vulnerability

• Microsoft Azure Logic Apps
• Path traversal
• Broken access control

Azure Cosmos DB Elevation of Privilege Vulnerability

• Microsoft Azure Cosmos DB
• Other injection

Azure Logic Apps Elevation of Privilege Vulnerability

• Microsoft Azure Logic Apps
• Broken access control

Microsoft 365 Copilot Elevation of Privilege Vulnerability

• Microsoft 365 Copilot
• Command injection

Azure Arc Elevation of Privilege Vulnerability

• Microsoft Azure ARC
• CWE-441

Microsoft Dataverse Elevation of Privilege Vulnerability

• Microsoft Dataverse
• Authentication bypass

Microsoft Container Registry Elevation of Privilege Vulnerability

• Microsoft Azure Container Registry
• Broken access control

Azure Arc Elevation of Privilege Vulnerability

• Microsoft Azure ARC
• Path traversal

Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction

• prebid-server-java
• Server-side request forgery (SSRF)

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

• Authentication bypass

>=4.10.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php

• LabRedesCefetRJ WeGIA
• Authentication bypass
• Hard-coded credentials

WeGIA: Unauthenticated Auth Bypass + Local File Inclusion

• LabRedesCefetRJ WeGIA
• Path traversal
• Authentication bypass

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

• Memory corruption

Use after free in Google Chrome

• Google Chrome
• Memory corruption

Stack-based buffer overflow in Google Chrome

• Google Chrome
• Memory corruption

Use after free in Google Chrome

• Google Chrome
• Memory corruption

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

• Privilege escalation
• Broken access control

<2.0.14 · fixed in 2.0.14

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

• Code injection

<2.0.15 · fixed in 2.0.15

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

• Cross-site scripting (XSS)

<2.0.15 · fixed in 2.0.15

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

• SQL injection

<4.5.12 || >=4.6.0, <4.6.5 || >=5.0.0, <5.1.9 || >=5.2.0, <5.2.14 || >=5.3.0, <5.3.7 · fixed in 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7

Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream

• MongoDB Inc. C Driver
• Memory corruption

Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

• CWE-346

<2.0.16 · fixed in 2.0.16

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

• Path traversal
• Code injection

<2.0.1 · fixed in 2.0.1

Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors

• webrecorder browsertrix
• Command injection
• Privilege escalation

Wavelog: Unauthenticated Remote Code Execution

• wavelog
• Code injection
• Broken access control

Chamilo LMS: Student-to-admin stored XSS in private messages via v-html

• chamilo-lms
• Cross-site scripting (XSS)

OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

• open-reception appointment-booking-software
• Authentication bypass