CVE records
Vulnerabilities found during authorized testing and reported through coordinated disclosure, newest first.
CVE-2026-87772
TR-CERT CNA 7.8Privilege Escalation via Unrestricted Root Mount
An Incorrect Authorization vulnerability (CWE-863) combined with insecure mount options in Pardus About allows an unprivileged local desktop user to achieve local privilege escalation to root. The root helper mounted discovered partitions without nosuid, nodev, or noexec semantics while the polkit policy authorized active sessions without a password challenge. Upstream addressed the execution primitive in 1.2.5 by enforcing ro,nosuid,nodev,noexec mount flags.
Read casefile →CVE-2026-125330
GitHub CNA 7.5Workspace API Key Reaches Other Workspaces' Sessions, Files and Responses
In HarnessRouter Community Edition from 0.4.2 until 0.31.7, routes that take a session or response id checked only the caller's organization and not the workspace an API key was made in, while the session list was filtered by that workspace (CWE-639). A key of a non-default workspace that learned the id of another workspace's session in the same organization could read its metadata, turns, trace and files, overwrite files, cancel or delete it, and publish a share link for it. Organization boundaries held. Fixed in 0.31.7 (PR #417).
Read casefile →CVE-2026-112950
GitHub CNA 5.9Path Traversal via Windows Backslash in Redirect Mocks
The path traversal fix in @vitest/mocker (GHSA-82fw-gwwq-j7x9) could be bypassed on Windows. Redirect registration joined the client-supplied path with the Vite root using POSIX rules, so a ..\ segment passed the server.fs.allow check, while the later file read treated the backslash as a separator. A client that can reach the Vite dev server could register a redirect mock and read files outside the allowed root. Fixed in 4.1.12 and 5.0.3.
Read casefile →CVE-2026-107716
GitHub CNA 7.3Symlink Traversal Leading to Arbitrary File Read and Overwrite
DirectoryPromptRegistry in banks did not reject symbolic links for index.json or for .jinja prompt files (CWE-59, CWE-22). Where untrusted users can influence a prompt directory, for example through an extracted archive or a shared repository, a link pointing outside the registry root lets get() and _scan() disclose a file and set() overwrite one. Fixed in 2.5.1 (PR #79).
Read casefile →CVE-2026-102994
GitHub CNA 8.7Excessive Runtime When Parsing Long Indirect Object Tokens
A crafted PDF whose indirect object identifiers or generation numbers run on without whitespace made pypdf scan excessive input in read_until_whitespace, causing long runtimes and high memory use (CWE-400, CWE-407). An application that opens untrusted PDFs with pypdf could be made unavailable by a single file. Fixed in 6.18.0 (PR #4055).
Read casefile →CVE-2026-91117
Reserved 5.3Unhandled ValueError Crash via Embedded NUL Byte in Path
An Improper Input Validation vulnerability (CWE-20) in Archmonger ServeStatic allows remote unauthenticated attackers to cause an unhandled ValueError (500 crash) by sending a request path containing an embedded NUL byte that survives path normalization. In deployments where DEBUG=True or autorefresh is enabled, this unhandled exception crashes request handling and renders Django's technical debug page, exposing system file paths, installed apps, and environment configuration.
Read casefile →CVE-2025-6577
TR-CERT CNA 9.8SQL Injection (SQLi)
An Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) allowing SQL Injection in Akıllı Ticaret's E-Commerce Website. Affects versions before 4.5.001. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
CVE-2025-4764
TR-CERT CNA 8.0SQL Injection (SQLi)
An Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injection. The CVE record marks versions through 22012026 as affected and notes that the vendor did not respond to the coordinated disclosure. TR-CERT, as the CNA, scores the issue 8.0 with CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which assumes an adjacent network. NVD lists its own 8.8 with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which assumes network access.
CVE-2025-7743
TR-CERT CNA 9.6Cleartext Transmission of Sensitive Information
A Cleartext Transmission of Sensitive Information vulnerability (CWE-319) in Dolusoft Omaspot allows interception and privilege escalation. Affects versions before 12.09.2025. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
CVE-2025-7744
TR-CERT CNA 9.8SQL Injection (SQLi)
An Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) allowing SQL Injection in Dolusoft Omaspot. Affects versions before 12.09.2025. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.