| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out. |
| Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8. |
| OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad. |
| OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures. |
| SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebinds to loopback addresses, reaching internal services and metadata endpoints. |
| Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() on posts or products, or enumerate every vendor's digital-asset metadata. |
| A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks. |
| The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in subsys/bluetooth/host/classic/avrcp.c, allocated from the shared avctp_browsing_rx_pool with K_FOREVER. L2CAP invokes that callback from the Bluetooth RX work queue thread (bt_workq, "BT RX WQ"), both for the head buffer of a new SDU and — through l2cap_br_alloc_frag() and net_buf_append_bytes() — for every further fragment of a reassembled SDU. That same thread is the only context that ever releases these buffers, after bt_l2cap_br_recv_seg() delivers a completed SDU and calls net_buf_unref(), so a wait taken there can never be satisfied.
The pool holds CONFIG_BT_MAX_CONN + 1 buffers of CONFIG_BT_AVRCP_BROWSING_L2CAP_MTU bytes (two buffers of 339 bytes in the default configuration). A connected browsing peer can drain it because bt_l2cap_br_recv_seg() in subsys/bluetooth/host/classic/l2cap_br.c accepts the SDU length declared in an SAR_START segment without bounding it by br_chan->rx.mtu: a peer that announces a large SDU and then streams continuation segments forces one pool buffer per segment-worth of data. Once the pool is empty the next allocation blocks forever inside the callback.
Triggering the flaw requires a build with CONFIG_BT_CLASSIC and the experimental CONFIG_BT_AVRCP_BROWSING option, an application that registers AVRCP callbacks, and a BR/EDR peer that has established the AVRCP control channel and then the browsing channel, which requires an encrypted (paired) link. No malformed packet is needed — a few hundred bytes of ordinary segmented L2CAP traffic suffice.
The consequence is a permanent hang of the whole Bluetooth host, not just of AVRCP: the blocked thread drains bt_dev.rx_queue for all HCI ACL data and low-priority events and also runs the host's internal work items, so all connections stop being serviced and the state is unrecoverable without a reboot. There is no memory-corruption or information-disclosure component. The fix allocates with K_NO_WAIT, so an empty pool now yields a local-busy indication or a channel disconnect that the application can recover from. |
| Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance. |
| GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service. |
| Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.
A caller of the MCP endpoint can invoke endpoints the OpenAPI document
never declared, under the declared tool's HTTP method, using the credentials the
Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue. |
| Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.
With match_uri_encoded_slash enabled and skip_mtls_uri_regex
configured, a client without a certificate can reach an upstream
behind a route that requires one, limited to request paths that decode
to an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue. |
| Authentication bypass by spoofing vulnerability in Apache APISIX.
When a Route's configured headers carry a caller identity and the OpenAPI document declares
the same header, a caller can act as another identity against the
upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue. |
| Incorrect Authorization vulnerability in Apache APISIX.
An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.
This issue affects Apache APISIX: from 1.4.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue. |
| Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.
An unauthenticated client can reach upstream paths protected
by a route-level auth plugin when a route without auth exists on the
same upstream and the upstream does not collapse encoded dot segments.
This issue affects Apache APISIX: from 0.9 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue. |
| Authentication bypass by spoofing vulnerability in Apache APISIX.
On routes using jwe-decrypt with strict: false and a
forward_header distinct from the token header an unauthenticated
client can supply the value the upstream treats as gateway-decrypted
plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.
This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue. |
| Authentication bypass by spoofing vulnerability in Apache APISIX.
On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.
This issue affects Apache APISIX: from 3.8.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue. |
| Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13. |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4. |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. |
