PT-2026-103528

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.1 Description Content Injection occurs due to insufficient validation of a URL parameter in the PDF viewer. This flaw allows an attacker-controlled document to be loaded and displayed under the trust of the...

CVE-2026-102090: URL Redirection to Untrusted Site

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...

CVE-2026-68068

The Toptech TMS7 and TopHAT systems are vulnerable to a time-based blind SQL injection vulnerability. The flaw exists within the "screenID" parameter of the electronic transaction queue viewer feature, located in the manual transactions section. Exploitation could allow an attacker to execute arb...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in fast-uri (CVE-2026-75975, CVE-2026-76172)

Summary Multiple vulnerabilities in the fast-uri URI parsing library CVE-2026-75975, CVE-2026-76172 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-75975 DESCRIPTION: fast-uri is a URI parser for...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in DOMPurify (CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)

Summary Multiple Cross-Site Scripting XSS vulnerabilities in DOMPurify CVE-2026-41238, CVE-2026-41239, CVE-2026-41240 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.4.12 on Windows and version 3.4.13 on Linux. Vulnerability Details...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by an information disclosure vulnerability in urllib3 (CVE-2026-44431)

Summary An information disclosure vulnerability in the urllib3 HTTP client library CVE-2026-44431 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 2.7.0. Vulnerability Details CVEID:CVE-2026-44431 DESCRIPTION: urllib3 is an HTTP client library f...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437

The esengine DeepSeek-Reasonix (Reasonix Studio) desktop application contains an OS Command Injection vulnerability in the internal/gitcmd component. The root cause is the improper neutralization of special elements during the invocation of git diff filter.clean/smudge . A local attacker who can ...

CVE-2026-84739

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739

GitLab CE/EE versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are vulnerable to a Cross-site Scripting (XSS) issue. The root cause is the improper sanitization of path components within the merge request diff viewer . This flaw could allow an authenticated user to exe...

EUVD-2026-88687

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

EUVD-2026-88558

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way...

EUVD-2026-88510

A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure b...

EUVD-2026-88557

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

EUVD-2026-88556

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-102437: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...