CVE-2026-2198

Mongoid contains an unsafe reflection weakness in the document persistence layer. Passing keys from unauthenticated parties can trigger unintended internal method invocation instead of an array update, potentially causing deletion of stored records and unresponsiveness.

CareCam CM2507 IP cameras store the root password using a fixed legacy hash that is insufficiently resistant to offline cracking.

CM2507 IP cameras store wireless network credentials in cleartext within the device filesystem.

WACRM 0.7.0 and earlier has vulnerabilities: row-level security policies allow authenticated users to modify their own role and account ID, enabling privilege escalation and cross-tenant movement. Additionally, match_ai_knowledge_fts and match_ai_knowledge_semantic run as SECURITY DEFINER with no account membership check, allowing non-members to read another tenant's knowledge chunks.

libheif from 1.22.0 to 1.23.2 has a heap out-of-bounds write vulnerability. Crafted HEIF/HEIC/AVIF files with nested iden/auxl references cause duplicate Alpha planes with different bit depths, and scale_nearest_neighbor() allocates a buffer based on the first plane's 8-bit depth, leading to an overflow.

In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the "quick question" admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe container which limits the scope of what it can do, unless the non-default AllowGlobal directive is configured for the catalog being accessed.

kcp before 0.31.4 and 0.32.2 fails to strip inbound identity headers (X-Remote-User, X-Remote-Group, X-Remote-Extra-*) before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, gaining full privileges.

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 has a heap buffer underflow when processing multi-segment messages, which could allow an authenticated attacker to cause denial of service or arbitrary code execution.

IBM MQ Appliance has a heap buffer overflow in protocol message processing before authentication, allowing a remote attacker to cause DoS or potentially execute arbitrary code.

XWiki Rendering prior to 14.10.2 and 15.0 RC1 allows any user who can edit their profile or any document to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. The rendering output is included as HTML macro content without further escaping, allowing closure of the HTML macro and injection of script macros with programming rights.