Jpom 2.10.0-2.11.12 - Authentication Bypass

Jpom 2.10.0 through 2.11.12 contains an authentication bypass caused by injection of query conditions into the JPOM-USER-TOKEN header, letting unauthenticated attackers gain super-administrator access and execute commands, exploit requires crafted header injection. id: CVE-2026-120201 info: name:...

mooSocial v.3.1.8 - Cross-Site Scripting

Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. id: CVE-2023-44813 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha severity:...

EUVD-2026-123846

A improper neutralization of argument delimiters in a command 'argument injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admi...

EUVD-2026-123840

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or adm...

CVE-2026-126167

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or adm...

CVE-2026-126168

A improper neutralization of argument delimiters in a command 'argument injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admi...

CVE-2026-126167

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or adm...

CVE-2026-126167

A command injection vulnerability exists in FortiMail (versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.8, and all 7.2 versions). The root cause is the improper neutralization of special elements used in a command. An authenticated remote attacker with domain admin or admin privileges can send crafte...

CVE-2026-126167: Fortinet FortiMail: A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet…

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or adm...

CVE-2026-126166: Fortinet FortiMail: A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet…

A improper neutralization of argument delimiters in a command 'argument injection' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admi...

EUVD-2026-121267

Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries...

CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a...

EUVD-2026-118415

A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a...

CVE-2026-102638

A maliciously crafted HTML payload in the description of an electronic library .lbr file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage thi...

CVE-2026-102638 Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in the description of an electronic library .lbr file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage thi...

CVE-2026-102637 Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to re...

CVE-2026-102637

The Autodesk Fusion desktop application is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of input in the documentName parameter of a Fusion protocol URL. When a user invokes a maliciously crafted protocol URL, the application may execute an HTML payload, potent...

CVE-2026-102636 Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or...

Autodesk Fusion cross-site scripting vulnerability

Autodesk Fusion versions from 2705.1.30 up to and including 2706.1.14 contain a cross-site scripting vulnerability. This vulnerability arises because the documentName parameter in Fusion protocol URLs fails to properly handle maliciously crafted HTML payloads. When users access such protocol URLs...

CVE-2026-111583: Improper Privilege Management

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can pla...