CVE Vulnerabilities - 12 March 2026

StudioCMS: Malicious Admin Can Hijack Owner Account via Password Reset

CVE-2026-32103 GHSA-h7vr-cg25-jf8c

## Summary The POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password res...

6.8

Unsecured OAuth Consent Form Opens ChatGPT to Browser Attacks

CVE-2026-32112 GHSA-pf93-j98v-25pv

### Summary The ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach th...

6.8

ImageMagick: Large Image Can Cause Data Corruption

CVE-2026-30937 GHSA-qpg4-j99f-8xcg

A 32-bit unsigned integer overflow in the XWD (X Windows) encoder can cause an undersized heap buffer allocation. When writing a extremely large image...

6.8

ImageMagick: PCL Encoder Can Crash System

CVE-2026-28686 GHSA-467j-76j7-5885

A heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation. ``` WRITE of size 1 at 0x7e79f91f31a0 th...

6.8

ASUS Business System Control Interface: Unprivileged User Access to Sensitive Hardware

CVE-2025-15037

An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by a...

6.8

ImageMagick: Data corruption when editing images

CVE-2026-32259

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, when a memory allocati...

6.7

Hyper Data Protector: Unauthorized Access via Hard-Coded Password

CVE-2025-59388

A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability t...

6.6

Ella Core: Malformed Messages Can Crash the System

GHSA-j478-p7vq-3347 CVE-2026-32320

## Summary Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity prote...

6.5

Hyperterse: Database Queries Leaked in Search Tool

CVE-2026-31841 GHSA-92gp-jfgx-9qpv

Hyperterse allows users to specify database queries for tools to execute under the hood. As of [v2.0.0](https://github.com/hyperterse/hyperterse/relea...

6.5

Tinyauth's OIDC authorization code misuse allows other clients to access user tokens

GHSA-xg2q-62g2-cvcm CVE-2026-32245

### Summary The OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A mal...

6.5

ZeptoClaw: Spoofed Emails Can Bypass Sender Allowlist

GHSA-4cm8-xpfv-jv6f

### Summary The email channel authorizes senders based on the parsed `From` header identity only. If upstream email authentication/enforcement is weak...

6.5

ImageMagick allows attackers to write beyond memory limits in image files

CVE-2026-28493 GHSA-r39q-jr8h-gcq2

An integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted...

6.5

ImageMagick: Out of bounds read can crash software

CVE-2026-26284 GHSA-wrhr-rf8j-r842

The pcd coder lacks proper boundary checking when processing Huffman-coded data. The decoder contains an function that has an incorrect initialization...

6.5

ImageMagick crashes or leaks sensitive data when processing certain images

CVE-2026-25982 GHSA-pmq6-8289-hx3v

A heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder lo...

6.5

Cap'n Proto truncates large chunked transfer requests

CVE-2026-32240

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size par...

6.3

Cap'n Proto allows malicious HTTP requests with fake sizes

CVE-2026-32239

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, t...

6.3

Ignition Software: Unauthenticated Password Recovery Email Exposure

CVE-2025-13913

Inductive Automation Ignition Software is vulnerable to an unauthenticated API endpoint exposure that may allow an attacker to remotely change the "fo...

5.4

TinaCMS GraphQL allows malicious file creation and deletion

CVE-2026-24125 GHSA-2238-xc5r-v9hj

Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file...

6.3

OpenClaw system.run approvals allow malicious script changes

GHSA-8g75-q649-6pv6

OpenClaw's `system.run` approval flow did not bind mutable interpreter-style script operands across approval and execution. A caller could obtain app...

6.3

devalue.parse and unflatten can be tricked, causing crashes or data corruption

CVE-2026-30226 GHSA-cfw5-2vxh-hr84

In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploi...

6.3

Streamsoft Prestiż: KSeF Token Can Be Guessable

CVE-2026-0809

Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed aft...

6.3

OpenClaw: Malicious Code Can Be Injected Via Skill Configuration

GHSA-wgx8-r9vw-2w4h

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-82g8-464f-2mv7. This link is maintained to preserve external...

5.3

OpenClaw 2026.2.19-2: Remote code injection possible via skill configuration

CVE-2026-4039

A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill En...

5.3

SourceCodester Pharmacy System allows unauthorized access to admin

CVE-2026-4013

A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_ad...

5.3

CodeGenieApp serverless-express: Unverified User Input Can Be Injected

CVE-2026-3992

A weakness has been identified in CodeGenieApp serverless-express up to 4.17.1. This affects an unknown part of the file utils/dynamodb.ts of the comp...

5.3