EUVD-2026-89954

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is...

CVE-2026-103118

A vulnerability exists in GraphicsMagick up to version 1.3.47 within the WPG File Handler component. Specifically, the ExtractPostscript function in the file coders/wpg.c is susceptible to uncontrolled recursion when processing manipulated input. This issue can be triggered via a remote attack . ...

CVE-2026-103118 GraphicsMagick WPG File wpg.c ExtractPostscript recursion

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is...

CVE-2026-103118 GraphicsMagick WPG File wpg.c ExtractPostscript recursion

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is...

CVE-2026-103118

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is...

CVE-2026-103116

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LOsort causes sql injection. The attack can be initiated remotely. The...

CVE-2026-103117

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103115

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The...

CVE-2026-93547

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547

The Vaadin Spreadsheet component (including the Spreadsheet add-on for Vaadin Framework 7 and 8) contains a missing authorization check that allows authenticated users to add or replace cell comments on sheets with enabled protection, including locked cells. The underlying cause is that the handl...

EUVD-2026-89952

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

@digital-realty/grid (1.2.4-IXUAT-11104.552907), @vaadin/hilla-react-crud (>=24.10.0, <=24.10.8) +4 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.10.0, <=24.10.4)

@vaadin/component-base NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

CVE-2026-91860

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base . The flaw occurs because the application fails to filter keys that address the prototype chain when merging user-controlled objects (e.g., parsed JSON) into chart configurations or a c...

CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

@digital-realty/app-shell (>=11.0.0, <=16.0.4), @digital-realty/global-portal-app-shell (>=1.0.0-alpha.1, <=1.0.0-alpha.2) +18 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.7.0, <=24.7.12)

@vaadin/component-base NPM version =24.7.0, =11.0.0, =1.0.0-alpha.1, =1.2.4-IXUAT-11104.553004, =1.2.5, =1.2.28, =1.1.33, =1.0.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0, =1.0.0-alpha.1, =1.0.0-alpha.1, =24.7.0, =24.7.0, =24.7.12 and more Source cves: CVE-2026-91860 Source advisory...

@arcgis/core (>=4.34.0-next.20, <=4.34.0-next.85), @vaadin-component-factory/vcf-date-time-range-picker (1.0.0) +71 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.8.0-alpha1, <=24.9.17)

@vaadin/component-base NPM version =24.8.0-alpha1, =4.34.0-next.20, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.9.0-rc1 and more...

@arcgis/core (>=5.0.0-next.108, <=5.1.0-next.52), @geoscene/charts-components (>=5.0.19, <=5.0.21) +89 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=25.0.0, <=25.1.11)

@vaadin/component-base NPM version =25.0.0, =5.0.0-next.108, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.13.1, =1.13.1, =1.25.0-snapshot.20260612103548 and more Source cves:...