CVE-2026-35194

The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.

The Access Control System by Armiya Information Technologies Ltd. Co. contains an open redirect vulnerability to an untrusted site. The issue affects versions before Versiyon 2 and allows faking the source of data.

The GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication. Remote clients can retrieve PTZ information and issue PTZ or raw serial commands.

The GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection. A captured PasswordDigest token can be replayed for subsequent ONVIF operations.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), causing attacker-controlled out-of-bounds heap reads and writes.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), each glyph's bitmap is copied into a single buffer, and existing checks only validate that the source slice (position, length) lies within the source bitmap buffer. They do not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64), resulting in 64000 bytes written into a 64-byte destination buffer — a heap buffer overflow with attacker-controlled content.

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.

The Access Control System by Armiya Information Technologies Ltd. Co. contains an SQL injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions before Versiyon 2.

Velociraptor allows some sensitive artifacts to be gated by additional permissions, e.g. Linux.Sys.BashShell requires EXECVE. However, no such check was implemented for client monitoring artifacts, and there was no requirement that they carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts.

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in is_file_type_valid(), which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass. This makes it possible for unauthenticated attackers to upload executable files and achieve remote code execution.