CVE-2026-64682

In the Nitrite (NO2) database prior to version 4.4.1, MVStoreUtils.openOrCreate() automatically detects a legacy v1 format and triggers a migration path that deserializes stored values via java.io.ObjectInputStream.readObject() without any class allowlist or ObjectInputFilter. Any Serializable class reachable on the embedding application's classpath can be instantiated, which is a precondition for remote code execution if a suitable gadget class (e.g. from commons-collections) is present.

In Waline versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer, injecting it via v-html. When editing a comment, the editor is seeded with the raw, un-sanitized body, so an administrator who clicks Edit on an attacker's comment renders that raw HTML in their own session, leading to stored XSS and privilege escalation.

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

An improper authorization vulnerability in Fortinet FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 may allow an unauthenticated attacker able to reach the FGFM port to execute code or commands via crafted FGFM packets.

The react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages from 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1 are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value; applications without server-side React code or without a framework/bundler supporting React Server Components are not affected.

The Basel Post Types plugin for WordPress (versions up to and including 1.18) contains a coding error in its authentication logic that causes a hardcoded SECURE_AUTH_SALT value, publicly visible in the theme source, to be used permanently. Because the salt is static and known, an unauthenticated attacker can forge an Opauth signature offline and submit a crafted callback to authenticate as any existing WordPress user, including administrators. Exploitation requires WooCommerce to be active and a configured social-login provider (Facebook, Google, or VKontakte).

In the Zephyr HTTP server's HTTP/2 front-end, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter, overwriting the count of unprocessed bytes in the per-connection receive buffer. Serving any static file via an unauthenticated HTTP/2 GET caused client->data_len to be replaced with the file's on-disk size, leading to out-of-bounds reads and writes and memory corruption. The flaw affects applications registering a static filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y.

N-able N-central before version 26.4.1 is vulnerable to improper restriction of XML external entity references, allowing XML Schema Poisoning. The issue affects versions prior to 26.4.1.

N-able N-central before version 26.4.1 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to force server-side requests. The issue affects versions prior to 26.4.1.

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 incorrectly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to perform privileged actions. Fixed in version 9.2.41.