CVE-2026-8548

The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.

The Access Control System by Armiya Information Technologies Ltd. Co. contains an open redirect vulnerability to an untrusted site. The issue affects versions before Versiyon 2 and allows faking the source of data.

The GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication. Remote clients can retrieve PTZ information and issue PTZ or raw serial commands.

The GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection. A captured PasswordDigest token can be replayed for subsequent ONVIF operations.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), causing attacker-controlled out-of-bounds heap reads and writes.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), each glyph's bitmap is copied into a single buffer, and existing checks only validate that the source slice (position, length) lies within the source bitmap buffer. They do not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64), resulting in 64000 bytes written into a 64-byte destination buffer — a heap buffer overflow with attacker-controlled content.

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

The Access Control System by Armiya Information Technologies Ltd. Co. contains an SQL injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions before Versiyon 2.