CVE-2026-109653

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any...

CVE-2026-109653

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that record fields are rendered into an HTML attribute context without proper escaping. A low-privilege user can inject a malicious payload into a...

CVE-2026-109652

Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0 are vulnerable to a Server-Side Template Injection (SSTI) . The root cause is a lack of validation on user-controlled message fields prior to template rendering, enabling the execution of expressions in an unrestricted context. Authe...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

CVE-2026-41504

The OWASP Coraza WAF library (versions 3.0.0 through 3.7.0 ) is vulnerable to CRLF injection within its Native audit-log formatter. Specifically, the file internal/auditlog/formats.go fails to neutralize carriage returns ( ) and line feeds ( ) in attacker-influenced request/response bodies, heade...

CVE-2026-41504 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When...

CVE-2026-109335

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...

CVE-2026-109396

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

CVE-2026-109392

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...

CVE-2026-109335 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...

EUVD-2026-97637

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...

CVE-2026-109335

SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to an information disclosure flaw involving COMPUTED fields . The root cause allows users to bypass field-level SELECT permissions by accessing records where readable COMPUTED fields are derived from hidden fields. Additionally, attackers can u...

CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

CVE-2026-109396

The Thelia platform (versions before 3.1.2 and 3.2.x before 3.2.1 ) is vulnerable to a CSV formula injection vulnerability. The issue resides in the CSVSerializer component, which exports fields like registration, checkout, or newsletter data verbatim. Unauthenticated visitors can exploit this by...

CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +,...

EUVD-2026-97490

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...

CVE-2026-92681

The @neo4j/graphql library (versions up to and including 7.6.3 ) contains a vulnerability where @authentication directives applied at the schema level or on Query/Mutation types are ignored for top-level fields annotated with @cypher . This occurs because only directives placed directly on indivi...

CVE-2026-109165

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...