CVE-2026-97301: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Cool Formkit Lite = 2.7.8 versions...

CVE-2026-103398: External Control of File Name or Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

CVE-2026-102137: Unrestricted Upload of File with Dangerous Type

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...

CVE-2026-96349: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in SiteSkite = 2.1.8 versions...

CVE-2026-102136: Improper Neutralization of CRLF Sequences

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

CVE-2026-102110: Missing Authentication for Critical Function

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...

CVE-2026-97292: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...

CVE-2026-79625: Concurrent Execution using Shared Resource with Improper Synchronization

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...

CVE-2026-102117: Reliance on Untrusted Inputs in a Security Decision

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could...

Karma Pro 0.12

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

CVE-2026-100267: Inefficient Regular Expression Complexity

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters...

CVE-2026-81310: Improper Link Resolution Before File Access

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance...

CVE-2026-97077: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ad Inserter = 2.8.18 versions...

CVE-2026-97261: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Notivo = 1.4.2 versions...

CVE-2026-97289: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...

CVE-2026-97235: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in ThemeREX Addons 2.45.0 versions...

CVE-2026-100276: Incorrect Authorization

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...

CVE-2026-96836: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Parsi Date = 6.3 versions...

PT-2026-102997

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance...

CVE-2026-102119: Improper Limitation of a Pathname to a Restricted Directory

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...