CVE-2026-97323

A path traversal vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (up to version 2026.08). The flaw resides in the getOriginalFilename function within the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.ja...

CVE-2026-89325

The Rapid7 Insight Agent on Windows is vulnerable to local privilege escalation due to an uncontrolled search path element in InsightVM assessment content. Assessment content at or below version 0.0.261.0 invoked the code command without a fully qualified path from a process running as SYSTEM . A...

CVE-2026-86860

The ServiceNow AI Platform contains a missing authorization vulnerability that could allow an unauthenticated user to extract instance data beyond intended limits, potentially leading to privilege escalation . ServiceNow has released security updates for hosted instances and provided updates for ...

CVE-2026-56792

Versions prior to 5.2.206 of Dell Rugged Control Center (RCC) are affected by an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this flaw to achieve Elevation of Privileges . No specific exploitation details or exploit links are provide...

CVE-2026-81473

Versions prior to 5.2.206 of Dell Rugged Control Center (RCC) are affected by an Improper Authorization vulnerability. A low-privileged attacker with local access could exploit this flaw to achieve Elevation of Privileges . While specific technical details regarding the root cause are not provide...

CVE-2026-86859

The ServiceNow AI Platform is affected by an authorization bypass security issue. If exploited, an unauthenticated user could gain access to data within the platform that they are not entitled to see, potentially leading to further unintended access. ServiceNow has already deployed a security upd...

CVE-2026-13016

The ServiceNow AI Platform contains a SQL injection vulnerability that could allow an unauthenticated user to execute arbitrary SQL statements against the instance's underlying database. Successful exploitation could result in unauthorized access to, or modification of, instance data. ServiceNow ...

CVE-2026-97322

A cross-site scripting (XSS) vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (versions up to 2026.08). The flaw affects an unspecified function within the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileControll...

CVE-2026-81455

Dell ThinOS 10 versions prior to SecurityAddon_2605.10.2766_T10 are susceptible to a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access can exploit this flaw to gain Unauthorized access . For remediation, users should apply the security upda...

CVE-2026-57440

The EmbedVideo Extension for MediaWiki is vulnerable to HTML/JavaScript injection in versions prior to 4.1.0 . When the $wgEmbedVideoRequireConsent setting is disabled, the extension fails to sanitize video URLs passed into an iframe src attribute. An attacker can provide a malformed URL or ID us...

CVE-2026-86858

An improper access control security issue exists in the ServiceNow AI Platform , which could allow an unauthenticated user to create, modify, or delete instance data beyond intended limits. The CVELIST document specifies this as an Unauthenticated Privilege Escalation via GraphQL . ServiceNow rel...

CVE-2026-82157

Dell ThinOS 10 versions prior to SecurityAddon_2605.10.2766_T10 are affected by an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access can exploit this flaw to achieve a protection mechanism bypass and gain unauthorized access . Remediation is a...

CVE-2026-86857

An authorization bypass vulnerability exists in the ServiceNow AI Platform . This flaw could allow an authenticated user to access data they are not entitled to, potentially leading to further unintended access. ServiceNow has remediated the issue and deployed updates to hosted instances, providi...

CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...

CVE-2026-52853

The open-source collaborative wiki software Docmost is vulnerable to privilege escalation prior to version 0.90.1 . An authenticated workspace ADMIN can bypass role ceilings within the workspace invitation flow to invite an external email address with OWNER permissions. This flaw allows an ADMIN ...

CVE-2026-61823

The code16 Sharp framework (a Laravel-based CMS/admin interface) is vulnerable to stored cross-site scripting (XSS) in versions prior to 9.22.5 . The root cause is that the rich-text editor's HTML sanitizer allows the srcdoc attribute on iframe elements. While the sanitizer HTML-encodes the inter...

CVE-2026-48072

Docmost , an open-source collaborative wiki and documentation software, is vulnerable to a path traversal flaw in versions prior to 0.80.1 . The public avatar and logo image endpoints fail to confine file path segments to the intended directory, allowing an unauthenticated attacker to traverse ou...

CVE-2026-97321

The YunaiV/zhijiantianya ruoyi-vue-pro software (up to version 2026.08) contains a SQL injection vulnerability in the GoView Data Endpoint component. Specifically, the GoViewDataServiceImpl.getDataBySQL function in the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/...

CVE-2026-52850

The open-source wiki software Docmost is vulnerable to a broken access control flaw in its transclusion / sync-block lookup API prior to version 0.90.1 . An authenticated workspace member who lacks permission to access a private space can retrieve confidential sync-block content and source page m...

CVE-2026-65827

The open-source collaborative wiki software Docmost is vulnerable to a denial of service via an unbounded ZIP decompression (zip-bomb) in the page-import feature. In versions 0.21.0 through 0.95.0 , an authenticated workspace member with edit rights can upload an archive that lacks limits on tota...