CVE-2026-90149

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

In Kubeflow Pipelines prior to 2.18.0, the multi-user HTTP endpoints for uploading pipelines and pipeline versions skip SubjectAccessReview when the target namespace is empty and REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission. If the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass.

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND node. The exposed macaroon can be used to gain full control of the LND node, including moving funds, resulting in theft of funds.

The MatchPoint Android app incorrectly validates TLS certificates due to a TrustManager that accepts any certificate and a permissive hostname validator. The app also allows unencrypted HTTP traffic, enabling an attacker who intercepts traffic to read and modify communications, including credentials and personal data.

An insecure direct object reference (IDOR) vulnerability in the MatchPoint API relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and physical-access QR codes, as well as modification of third-party accounts, password changes, impersonation, and virtual balance transfers.

A static credential embedded in the MatchPoint mobile app has been reported to return the 'autorizado' token. The report states that this token grants unauthenticated access to API services.

Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege in Cronicle can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. A key colliding with a security-sensitive environment variable can override the plugin execution context, potentially causing privilege escalation, arbitrary code execution, data access, or service disruption.

Prior to 1.6.1, MONAI's PydicomReader._get_affine() trusts non-finite values in DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values, causing inference failures, persistent datastore poisoning, or geometrically corrupted results.

Prior to 0.52.0, dcmjs's DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or DICOM rules. Scientific notation overflow in a DS or IS field can produce Infinity or NaN, and IntegerString accepts exponent notation and values outside the signed 32-bit IS range. Applications trusting these values can propagate invalid numbers into geometry, windowing, dose scaling, and volume reconstruction.