CVE-2026-11624

The Joomla extension OrdaSoft CCK before version 8.3.16 contains an unauthenticated SQL injection vulnerability. The order column for records was user provided and not properly validated, leading to a SQL injection vector.

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

A vulnerability has been detected in Totolink A3002MU version 1.0.0-B20230403.1455. It affects an unknown function in the file /boafrm/formIpQoS of the QoS Rule Handler component. Manipulation of the addQos/comment/entry_name arguments leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit has been publicly disclosed.

A weakness has been identified in Totolink A3002MU version 1.0.0-B20230403.1455. It affects the function sub_40FCFC in the file /bin/boa of the Authentication Check component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely, and the exploit has been made publicly available.

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.