Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.

Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match

Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.

Multiple vulnerabilities that affects IBM Db2 Genius Hub

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.

Visual Studio Code Security Feature Bypass Vulnerability

Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()

WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-Value Assertions in each Relative Distinguished Name and loses multi-value RDN grouping before DN name-constraint enforcement. An attacker controlling a name-constrained intermediate CA can issue a certificate with a multi-value RDN whose first Common Name matches the permitted constraint and whose second Common Name is attacker-chosen, causing the constraint check to accept the flattened first value. If the certificate contains no subjectAlternativeName extension, the second Common Name can then be accepted as a hostname; Botan does not fall back to Common Name hostname matching when any subjectAlternativeName is present. The exposure is limited to deployments using DN name constraints, which are uncommon outside internal PKIs, and to certificates without a subjectAlternativeName. This issue is fixed in version 3.13.0.

Hidden Run Control in Markdown Preview Enables Command Execution

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible

Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers.

AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters. To remediate this issue, users should upgrade to version 1.5.1.

Clickjacking issue in the Autofill component in Firefox for Android

Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.

IBM App Connect Enterprise is vulnerable to a clickjacking attack

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.

HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service

HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision

The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths and ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation whose name differs from a signed target only in dot positions can prime an Insecure verdict, causing forged answers for the target to skip signature verification instead of returning SERVFAIL.

Clickjacking Vulnerability in OpenText Directory Services

A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking. This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.

CSS Injection via Mermaid Diagram Configuration in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack

keys: make keyring key-chunk byte order agree with keyring_diff_objects()

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyring_diff_objects() keyring_get_key_chunk() loads description bytes into the index chunk low address first, while keyring_diff_objects() numbers the first differing bit from the low end and folds the absolute byte index into the level without removing the inline-prefix offset the level already carries. The two disagree on byte order and bit position, so the array can be told two keys first differ at a bit that does not differ in the chunk the walker uses, letting crafted descriptions collide into one node. Load the chunk in the order keyring_diff_objects() assumes and drop the inline-prefix length when folding the byte index into the level. This only changes the in-memory ordering used to place keys within a keyring; add, search and read of non-colliding keys are unaffected.

HID: usbhid: fix deadlock in hid_post_reset()

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix deadlock in hid_post_reset() You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them.