CVE-2026-2500

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic '<provider>.<id>' username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. An unauthenticated remote attacker who learns or guesses a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

A vulnerability was found in Edimax BR-6208AC 1.32 in an unknown function of the file '/goform/formWlSiteSurvey'. Manipulation of the 'ifname' argument causes a buffer overflow that can be exploited remotely. The exploit has been published and may be used; the vendor did not respond and the product is no longer supported.

A vulnerability was determined in Netcore NR268 1.7.121109 in the 'user_ok' function of the CGI Execution component. Manipulation causes improper authentication, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized; the vendor did not respond.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on individual fields are enforced. An application exposing a top-level @cypher field and relying on schema-level or type-level @authentication allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, potentially permitting reading and modifying data. Fixed in 7.6.4.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.