Unsalted MD5 password hashing in sfturing hosp_order (code through commit 627f426331da8086ce8fff2017d65b1ddef384f8) leaves stored user credentials cheaply crackable if the hash store is ever exposed. The defect is not a remotely reachable primitive: per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) an attacker with low privileges must first obtain the password digests - through a separate vulnerability, a database compromise, or a backup leak - before the missing salt provides any advantage, which is why impact is limited and complexity is high. Publicly available exploit code exists that demonstrates the weak hashing, but there is no confirmed active exploitation (no CISA KEV listing), and the project has not responded to the issue report, so no vendor-released patch is identified at time of analysis.
Qt Quick's SVG path parsers (Context2D.path in Canvas/Context2D and the QML PathSvg.path element) perform an out-of-bounds read when processing crafted SVG path strings, which can crash or destabilize the hosting application. The issue is reachable only when a Qt Quick/QML application actually feeds attacker-controlled SVG path data into these APIs - applications that render only trusted, bundled SVG assets are not exposed - and the vendor's CVSS 4.0 vector rates it local with low privileges required and passive user interaction, while the independent assessment lands at CVSS 3.1 4.9-equivalent severity with no confidentiality or integrity impact and only limited availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis (exploit maturity Unreported), and a vendor patch is available.