CVE-2026-106164

In the BlueSpice container image (bluespice/wiki), the default value of $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable was not set. An empty value disables the IP restriction in the token authenticator component, allowing any user with read access to the wiki to obtain a token from the REST API and get a session with sysop privileges as the internal service user.

The Participants Database plugin (participants-database) for WordPress by xnau webdesign is vulnerable to deserialization of untrusted data, allowing Object Injection. The issue affects versions up to and including 2.7.8.5.

The Participants Database plugin (participants-database) for WordPress by xnau webdesign contains an SQL Injection vulnerability (improper neutralization of special elements in an SQL command) enabling blind SQL injection. The issue affects versions up to and including 2.7.8.5.

CGM CLININET is vulnerable to local privilege escalation. The service processing incoming HL7 messages runs with root privileges, but due to incorrect permissions its scripts and configuration files can be modified by the uhcapache user, allowing execution of arbitrary code as root.

CGM CLININET is vulnerable to code injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted user-supplied data. An attacker from an adjacent network can supply a crafted query parameter to import an attacker-controlled module, resulting in arbitrary code execution with root privileges.

CGM CLININET is vulnerable to remote code execution caused by deserialization of untrusted data. The server exposes an HTTP-based API used by the administrative module that exchanges data using Java object serialization; an attacker on the same local network can send a crafted serialized object whose deserialization allows arbitrary code execution with root privileges.

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those systems. An attacker on an adjacent network able to send data to these HL7 processes can achieve remote code execution with root privileges.

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request. This may result in unauthorized access to user accounts and full administrative control of the LMS platform.

A firmware verification vulnerability in Creative Sound Blaster Katana allows an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. The lack of effective integrity verification enables installation of unauthorized software.

In Part-DB before version 2.12.1, the attachment upload handler's dangerous-extension blocklist does not include phar. A .phar file uploaded as an attachment is stored in public/media/ (the Apache document root), and the shipped Apache configuration routes .phar to PHP-FPM, allowing execution of arbitrary PHP.