CVE-2026-18781

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.

Predis, a Redis and Valkey client for PHP, versions 3.0.0-RC1 through 3.3.0, improperly processes the RESP buffer in aggregate connections, allowing an attacker to inject additional commands via keys or values containing CRLF sequences. This can lead to shard-wide cache deletion, targeted data modification, data reads, or node disruption. Only pipeline() is affected; transactions are not vulnerable. Fixed in version 3.3.0.

Next.js, a React framework for full-stack applications, versions 13.4.0 through 15.5.24 and 16.3.3, on Windows-hosted servers does not properly escape backslashes in route segments when constructing cache paths, allowing a remote attacker to traverse outside the cache root and expose private data, including the server-reference-manifest encryption key. Disclosure of this key can enable remote code execution. Fixed in versions 15.5.24 and 16.3.3.

Proxmox Virtual Environment (VE) versions 7.0 through 8.0 contain an authentication bypass vulnerability in libpve-access-control before 8.0.4, allowing unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.