CVE-2026-106150: Improper Neutralization of Input During Web Page Generation

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker wi...

CVE-2026-106153: Improper Neutralization of Input During Web Page Generation

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived...

CVE-2026-106157: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106158: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,...

CVE-2026-106159: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing...

CVE-2026-106160: Improperly Controlled Modification of Object Prototype Attributes

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype...

CVE-2026-106161: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-106163: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

CVE-2026-108116: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...

CVE-2026-46691: Missing Authorization

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-53575: Improper Neutralization of Input During Web Page Generation

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53582: XML Injection (aka Blind XPath Injection)

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php an...

CVE-2026-55875: Server-Side Request Forgery (SSRF)

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...

CVE-2026-63130: Improper Limitation of a Pathname to a Restricted Directory

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

CVE-2026-95180: Improper Access Control

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...

CVE-2026-57569: Time-of-check Time-of-use (TOCTOU) Race Condition

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-110364: Missing Authorization

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement...

CVE-2026-55842: Origin Validation Error

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern"" with setAllowCredentialstrue, causing Spring to reflect any requesting origin while allowing cookie...

CVE-2026-34015: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...

CVE-2026-76660: Improper Input Validation

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data...

CVE-2026-103910: Undefined Security Weakness

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-101335. Reason: This candidate is a reservation duplicate of CVE-2026-101335. Notes: All CVE users should reference CVE-2026-101335 instead of this candidate. All references and descriptions in this candidate have been...

CVE-2026-111229: Improper Neutralization of Special Elements used in an OS Command

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...

CVE-2026-111170: Improper Limitation of a Pathname to a Restricted Directory

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validatesubpath strips leading slashes while pathlib's join discards the base path...

CVE-2026-106604: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0...

CVE-2026-62679: Improper Limitation of a Pathname to a Restricted Directory

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-39993: Relative Path Traversal

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...

CVE-2026-101310: Buffer Over-read

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

CVE-2026-102464: Allocation of Resources Without Limits or Throttling

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Eclipse Vert.x MQTT vertx-mqtt MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map qos2inbound while awaiting the corresponding PUBREL packet to complete the...

CVE-2026-47786: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...

CVE-2026-104827: Allocation of Resources Without Limits or Throttling

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-57183: Improper Authentication

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with appsecretkey or parasecretkey for /api/config and /api/stats without requiring a registered API-key jti, and maps the...

CVE-2026-111150: Out-of-bounds Read

ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBl...

CVE-2026-57496: Improper Limitation of a Pathname to a Restricted Directory

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensinggetproduct passes the caller-controlled productnumber to src/netlicensingmcp/tools/products.py, which interpolat...

CVE-2026-24722: NULL Pointer Dereference

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2026-95155: Uncontrolled Recursion

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-102740: UNIX Symbolic Link (Symlink) Following

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path...

CVE-2026-104617: Insufficiently Protected Credentials

There are two invocations of qrencode to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system...

CVE-2026-76665: Out-of-bounds Read

A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow...

CVE-2026-77460: Authorization Bypass Through User-Controlled Key

EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is...

CVE-2026-79839: Stack-based Buffer Overflow

A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash...

CVE-2026-107416: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2...

CVE-2026-102477: Improper Handling of Highly Compressed Data (Data Amplification)

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

SUSE: CVE-2024-22031: SUSE Linux Security Advisory

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster,...

CVE-2026-100352: Improper Check for Unusual or Exceptional Conditions

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an...

CVE-2026-104586: Undefined Security Weakness

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

CVE-2026-106701: Undefined Security Weakness

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting XSS via the component WebSocketServer, SpringSecurityConfig, deploy.vue...

CVE-2026-109430: Improper Restriction of XML External Entity Reference

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity XXE injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to forc...

CVE-2026-110909: Improper Restriction of Communication Channel to Intended Endpoints

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

CVE-2026-110957: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...

CVE-2026-47168: Deserialization of Untrusted Data

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...