CVE-2026-13767

Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count.

Sites using craft.search for searching are vulnerable to unauthenticated SQL injection on the front end. The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This affects only MySQL/MariaDB and allows database read/write access and privilege escalation to administrator.

In pyLoad, UnTar._safe_extractall validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before tarfile.extractall. On Python 3.9–3.13, tarfile defaults to the fully_trusted filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. When pyLoad runs with OS privileges permitting device creation (e.g., official root-based Docker), this can expose raw devices and compromise the host.

Signal K Server versions 2.0.0 through 2.33.x and @signalk/resources-provider 1.0.0 through 1.5.2 have a REST route GET /signalk/v2/api/resources/:resourceType/:resourceId that accepts an unsafe resourceId able to escape the intended resource directory. Lack of path containment allows reading arbitrary JSON files reachable by the server, and related PUT and DELETE operations can write or delete files outside the storage root. Reading security.json exposes the HS256 JWT signing secret and password hashes, enabling forged admin tokens and further escalation.

SuperTokens Core versions from 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1 contain a flaw in Multitenancy.checkPermissionsForCreateOrUpdate that does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate API keys, an attacker holding one application's valid API key can update the parent domain, replace sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's key. The v2 create or update handlers, when the optional identifier is omitted, produce a base-tenant target that skips permission branches and the enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags affecting login integrity and availability; the base-target variant still rejects coreConfig and does not establish key theft. The issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Redpanda Connect versions 4.39 to 4.110 expose the management HTTP API on 0.0.0.0:4195 with authentication disabled by default, allowing an unauthenticated attacker with network access to TCP/4195 to achieve remote code execution (RCE). An attacker can POST a malicious pipeline definition to /streams/{id} containing code-executing processors (command, subprocess, ffi, sql_raw), achieving arbitrary command execution with the Redpanda Connect service account permissions. Starting with v4.111 the API is opt-in and no longer vulnerable by default, but RCE remains possible if the management API is manually enabled via --bind-http.

Tasmota through 16.0.0 (fixed in commit e97e1e4) contains a heap out-of-bounds write in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447. The messages cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. This can crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms lacking ASLR and heap cookies.

An uncontrolled search path element in the package upload feature in Chaos Software V-Ray through version 2.0.19 allows remote unauthenticated attackers to execute arbitrary code by redirecting access to libraries.

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability. An unauthenticated attacker can push a crafted serialized job onto the Redis-backed Laravel Horizon queue, leading to arbitrary code execution via the App\Jobs\TaskDownloadRun class and the bundled laravel/tinker package.

WidzialniCMS is vulnerable to unrestricted file upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.