CVE-2026-16735

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability because the UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

INDOTALENT WHMS before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count.

Sites using craft.search for searching are vulnerable to unauthenticated SQL injection on the front end. The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This affects only MySQL/MariaDB and allows database read/write access and privilege escalation to administrator.

In pyLoad, UnTar._safe_extractall validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before tarfile.extractall. On Python 3.9–3.13, tarfile defaults to the fully_trusted filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. When pyLoad runs with OS privileges permitting device creation (e.g., official root-based Docker), this can expose raw devices and compromise the host.

Signal K Server versions 2.0.0 through 2.33.x and @signalk/resources-provider 1.0.0 through 1.5.2 have a REST route GET /signalk/v2/api/resources/:resourceType/:resourceId that accepts an unsafe resourceId able to escape the intended resource directory. Lack of path containment allows reading arbitrary JSON files reachable by the server, and related PUT and DELETE operations can write or delete files outside the storage root. Reading security.json exposes the HS256 JWT signing secret and password hashes, enabling forged admin tokens and further escalation.

SuperTokens Core versions from 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1 contain a flaw in Multitenancy.checkPermissionsForCreateOrUpdate that does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate API keys, an attacker holding one application's valid API key can update the parent domain, replace sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's key. The v2 create or update handlers, when the optional identifier is omitted, produce a base-tenant target that skips permission branches and the enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags affecting login integrity and availability; the base-target variant still rejects coreConfig and does not establish key theft. The issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Redpanda Connect versions 4.39 to 4.110 expose the management HTTP API on 0.0.0.0:4195 with authentication disabled by default, allowing an unauthenticated attacker with network access to TCP/4195 to achieve remote code execution (RCE). An attacker can POST a malicious pipeline definition to /streams/{id} containing code-executing processors (command, subprocess, ffi, sql_raw), achieving arbitrary command execution with the Redpanda Connect service account permissions. Starting with v4.111 the API is opt-in and no longer vulnerable by default, but RCE remains possible if the management API is manually enabled via --bind-http.

Tasmota through 16.0.0 (fixed in commit e97e1e4) contains a heap out-of-bounds write in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447. The messages cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. This can crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms lacking ASLR and heap cookies.