Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3499 vulnerabilities
CVE-2026-110005 (GCVE-0-2026-110005)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:23 – Updated: 2026-10-13 20:08
VLAI
EPSS
VEX
Title
Moghtech Komodo contains an OS command injection vulnerability
Summary
The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.
Severity
No CVSS data available.
CWE
Assigner
References
2 references
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T20:08:24.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/456950"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Komodo",
"vendor": "Komodo",
"versions": [
{
"lessThan": "2.3.0",
"status": "affected",
"version": "1.19.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The `periphery` agent\u0027s container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo\u0027s `Terminal` permission to obtain unrestricted host-level command execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:23:52.191Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/moghtech/komodo"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Moghtech Komodo contains an OS command injection vulnerability",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-110005"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-110005",
"datePublished": "2026-10-13T19:23:52.191Z",
"dateReserved": "2026-10-13T13:54:36.279Z",
"dateUpdated": "2026-10-13T20:08:24.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16753 (GCVE-0-2026-16753)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:21 – Updated: 2026-10-13 20:08
VLAI
EPSS
VEX
Title
CVE-2026-16753
Summary
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
Severity
No CVSS data available.
Assigner
References
2 references
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T20:08:25.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/382143"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Lowcoder",
"vendor": "Lowcoder",
"versions": [
{
"lessThanOrEqual": "2.4.10",
"status": "affected",
"version": "2.1.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:21:10.107Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/lowcoder-org/lowcoder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-16753",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-16753"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-16753",
"datePublished": "2026-10-13T19:21:10.107Z",
"dateReserved": "2026-07-23T13:00:05.196Z",
"dateUpdated": "2026-10-13T20:08:25.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104937 (GCVE-0-2026-104937)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:15 – Updated: 2026-10-13 20:08
VLAI
EPSS
VEX
Title
CVE-2026-104937
Summary
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token.
The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.
Severity
No CVSS data available.
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-13T20:08:23.554Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/157374"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Shopware",
"vendor": "Shopware",
"versions": [
{
"status": "affected",
"version": "6.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Shopware version 6.7 allows the upload of attacker\u2011controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator\u0027s authentication token.\r\n\r\nThe compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension\u2011management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:15:10.935Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/157374"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-104937",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-104937"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-104937",
"datePublished": "2026-10-13T18:15:10.935Z",
"dateReserved": "2026-10-02T17:10:28.555Z",
"dateUpdated": "2026-10-13T20:08:23.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84286 (GCVE-0-2026-84286)
Vulnerability from cvelistv5 – Published: 2026-10-12 17:01 – Updated: 2026-10-12 17:14
VLAI
EPSS
VEX
Title
OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
Summary
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Turboderp-org | ExLlamaV3 |
Affected:
3
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-12T17:14:02.436Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/369611"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ExLlamaV3",
"vendor": "Turboderp-org",
"versions": [
{
"status": "affected",
"version": "3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ExLlamaV3\u2019s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out\u2011of\u2011range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-125 Out-of-bounds Read",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-787 Out-of-bounds Write",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-20 Improper Input Validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T17:06:12.603Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/369611"
},
{
"url": "https://github.com/turboderp-org/exllamav3/pull/310"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-84286"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-84286",
"datePublished": "2026-10-12T17:01:16.032Z",
"dateReserved": "2026-09-01T15:47:57.172Z",
"dateUpdated": "2026-10-12T17:14:02.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107248 (GCVE-0-2026-107248)
Vulnerability from cvelistv5 – Published: 2026-10-12 15:06 – Updated: 2026-10-12 15:06
VLAI
EPSS
VEX
Title
CVE-2026-107248
Summary
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.
Severity
No CVSS data available.
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"status": "affected",
"version": "3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia 3.0.0\u0027s back-office Email/Messages feature contains a server\u2011side template injection (SSTI) flaw that allows any authenticated user with the \u201cMessages\u201d permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T15:06:55.302Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-107248",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-107248"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-107248",
"datePublished": "2026-10-12T15:06:55.302Z",
"dateReserved": "2026-10-07T15:19:06.002Z",
"dateUpdated": "2026-10-12T15:06:55.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103537 (GCVE-0-2026-103537)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:56 – Updated: 2026-10-12 14:56
VLAI
EPSS
VEX
Title
CVE-2026-103537
Summary
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.
Severity
No CVSS data available.
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server\u0027s privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:56:21.364Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103537",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103537"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103537",
"datePublished": "2026-10-12T14:56:21.364Z",
"dateReserved": "2026-09-30T19:07:13.961Z",
"dateUpdated": "2026-10-12T14:56:21.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103535 (GCVE-0-2026-103535)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55
VLAI
EPSS
VEX
Title
CVE-2026-103535
Summary
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.
Severity
No CVSS data available.
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file\u0027s write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web\u2011accessible paths. Separately, the translation\u2011writing logic does not escape `\\` in user\u2011supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web\u2011server\u2019s privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:55:58.210Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103535",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103535"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103535",
"datePublished": "2026-10-12T14:55:58.210Z",
"dateReserved": "2026-09-30T19:07:09.910Z",
"dateUpdated": "2026-10-12T14:55:58.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103529 (GCVE-0-2026-103529)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55
VLAI
EPSS
VEX
Title
CVE-2026-103529
Summary
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.
Severity
No CVSS data available.
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module\u0027s `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:55:38.419Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103529",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103529"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103529",
"datePublished": "2026-10-12T14:55:38.419Z",
"dateReserved": "2026-09-30T19:06:44.630Z",
"dateUpdated": "2026-10-12T14:55:38.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103528 (GCVE-0-2026-103528)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55
VLAI
EPSS
VEX
Title
CVE-2026-103528
Summary
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.
Severity
No CVSS data available.
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:55:14.883Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103528",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103528"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103528",
"datePublished": "2026-10-12T14:55:14.883Z",
"dateReserved": "2026-09-30T19:06:40.650Z",
"dateUpdated": "2026-10-12T14:55:14.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103527 (GCVE-0-2026-103527)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:54
VLAI
EPSS
VEX
Title
CVE-2026-103527
Summary
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.
Severity
No CVSS data available.
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia v2.6.0\u0027s Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the \u201cnext\u201d parameter, enabling reflected Cross\u2011Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker\u2011controlled JavaScript."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:54:53.807Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103527",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103527"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103527",
"datePublished": "2026-10-12T14:54:53.807Z",
"dateReserved": "2026-09-30T19:06:35.476Z",
"dateUpdated": "2026-10-12T14:54:53.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103526 (GCVE-0-2026-103526)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:58
VLAI
EPSS
VEX
Title
CVE-2026-103526
Summary
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-12 14:58 UTC
CWE
- CWE-204 Observable Response Discrepancy
- CWE-204 - Observable Response Discrepancy
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-103526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-12T14:58:37.804196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204 Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:58:40.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-204 Observable Response Discrepancy",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:54:35.007Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103526",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103526"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103526",
"datePublished": "2026-10-12T14:54:35.007Z",
"dateReserved": "2026-09-30T19:06:30.711Z",
"dateUpdated": "2026-10-12T14:58:40.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103524 (GCVE-0-2026-103524)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:54
VLAI
EPSS
VEX
Title
CVE-2026-103524
Summary
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.
Severity
No CVSS data available.
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store\u0027s product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:54:16.912Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103524",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103524"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103524",
"datePublished": "2026-10-12T14:54:16.912Z",
"dateReserved": "2026-09-30T19:05:23.379Z",
"dateUpdated": "2026-10-12T14:54:16.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103523 (GCVE-0-2026-103523)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:53 – Updated: 2026-10-12 14:53
VLAI
EPSS
VEX
Title
CVE-2026-103523
Summary
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.
Severity
No CVSS data available.
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the \u201cAdd New Address\u201d form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:53:54.845Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103523",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103523"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103523",
"datePublished": "2026-10-12T14:53:54.845Z",
"dateReserved": "2026-09-30T19:05:18.631Z",
"dateUpdated": "2026-10-12T14:53:54.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103522 (GCVE-0-2026-103522)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:53 – Updated: 2026-10-12 14:59
VLAI
EPSS
VEX
Title
CVE-2026-103522
Summary
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-12 14:59 UTC
CWE
- CWE-434 Unrestricted Upload of File with Dangerous Type
- CWE-20 Improper Input Validation
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-103522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-12T14:59:38.844888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:59:41.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client\u2011supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-20 Improper Input Validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:53:34.695Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103522",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103522"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103522",
"datePublished": "2026-10-12T14:53:34.695Z",
"dateReserved": "2026-09-30T19:03:43.339Z",
"dateUpdated": "2026-10-12T14:59:41.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103521 (GCVE-0-2026-103521)
Vulnerability from cvelistv5 – Published: 2026-10-12 14:52 – Updated: 2026-10-12 15:00
VLAI
EPSS
VEX
Title
CVE-2026-103521
Summary
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-12 15:00 UTC
CWE
- CWE-434 Unrestricted Upload of File with Dangerous Type
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-103521",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-12T15:00:35.233527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T15:00:39.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thelia",
"vendor": "Thelia",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T14:52:56.850Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/162329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-103521",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103521"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-103521",
"datePublished": "2026-10-12T14:52:56.850Z",
"dateReserved": "2026-09-30T19:03:23.929Z",
"dateUpdated": "2026-10-12T15:00:39.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107709 (GCVE-0-2026-107709)
Vulnerability from cvelistv5 – Published: 2026-10-08 16:59 – Updated: 2026-10-08 20:23
VLAI
EPSS
VEX
Title
Bower decompress-zip has a path traversal vulnerability
Summary
A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause files to be written outside the intended extraction directory. Successful exploitation may allow arbitrary file overwrite, application compromise, or remote code execution depending on the target environment and writable sibling paths.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 20:23 UTC
CWE
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bower Decompress-Zip | decompress-zip |
Affected:
0 , ≤ 0.3.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-107709",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T20:23:09.377657Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:23:46.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "decompress-zip",
"vendor": "Bower Decompress-Zip",
"versions": [
{
"lessThanOrEqual": "0.3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause files to be written outside the intended extraction directory. Successful exploitation may allow arbitrary file overwrite, application compromise, or remote code execution depending on the target environment and writable sibling paths."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:59:10.419Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/bower/decompress-zip"
},
{
"url": "https://moizxsec.github.io/writeups/decompress-zip-zip-slip-sibling-prefix-bypass/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Bower decompress-zip has a path traversal vulnerability",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-107709"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-107709",
"datePublished": "2026-10-08T16:59:10.419Z",
"dateReserved": "2026-10-08T16:57:51.188Z",
"dateUpdated": "2026-10-08T20:23:46.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93034 (GCVE-0-2026-93034)
Vulnerability from cvelistv5 – Published: 2026-10-08 14:00 – Updated: 2026-10-08 20:22
VLAI
EPSS
VEX
Title
CVE-2026-93034
Summary
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 20:22 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-93034",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T20:22:09.915843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:22:35.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SGLang",
"vendor": "SGLang",
"versions": [
{
"lessThanOrEqual": "v0.5.20",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:00:09.084Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/sgl-project/sglang/tree/main"
},
{
"url": "https://m00dy.sh/notes/disabling-pickle-did-not-remove-pickle?palette=mineral"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-93034",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-93034"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-93034",
"datePublished": "2026-10-08T14:00:09.084Z",
"dateReserved": "2026-09-17T15:20:20.432Z",
"dateUpdated": "2026-10-08T20:22:35.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107202 (GCVE-0-2026-107202)
Vulnerability from cvelistv5 – Published: 2026-10-07 14:26 – Updated: 2026-10-07 20:39
VLAI
EPSS
VEX
Title
CVE-2026-107202
Summary
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 20:39 UTC
CWE
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/jonssonyan/h-ui |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jonssonyan | h-ui |
Affected:
0.0.25
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-107202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:39:27.581777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T20:39:57.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "h-ui",
"vendor": "jonssonyan",
"versions": [
{
"status": "affected",
"version": "0.0.25"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:26:49.905Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/jonssonyan/h-ui"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-107202",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-107202"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-107202",
"datePublished": "2026-10-07T14:26:49.905Z",
"dateReserved": "2026-10-07T14:22:10.000Z",
"dateUpdated": "2026-10-07T20:39:57.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106550 (GCVE-0-2026-106550)
Vulnerability from cvelistv5 – Published: 2026-10-06 20:09 – Updated: 2026-10-07 19:33
VLAI
EPSS
VEX
Title
CVE-2026-106550
Summary
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:05 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-400 - Uncontrolled Resource Consumption (‘Denial of Service’)
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Node-convict |
Affected:
6.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:05:14.037126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:05:19.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Node-convict",
"vendor": "Mozilla",
"versions": [
{
"status": "affected",
"version": "6.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mozilla\u0027s Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype\u2011pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.\u003ckey\u003e, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u2018Prototype Pollution\u2019)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-400: Uncontrolled Resource Consumption (\u2018Denial of Service\u2019)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:33:03.505Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/mozilla/node-convict"
},
{
"url": "https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-106550",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-106550"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-106550",
"datePublished": "2026-10-06T20:09:55.919Z",
"dateReserved": "2026-10-06T20:07:46.075Z",
"dateUpdated": "2026-10-07T19:33:03.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106511 (GCVE-0-2026-106511)
Vulnerability from cvelistv5 – Published: 2026-10-06 18:52 – Updated: 2026-10-07 17:55
VLAI
EPSS
VEX
Title
CVE-2026-106511
Summary
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 17:53 UTC
CWE
- CWE-862 Missing Authorization
- CWE-863 Incorrect Authorization
- CWE-306 Missing Authentication for Critical Function
- CWE-862 - Missing Authorization
- CWE-863 - Incorrect Authorization
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MultiversX Labs S.R.L. | multisig-improved |
Affected:
GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106511",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T17:53:21.355591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:55:09.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "multisig-improved",
"vendor": "MultiversX Labs S.R.L.",
"versions": [
{
"status": "affected",
"version": "GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MultiversX\u0027s multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract\u0027s EGLD/ESDT balance in two transactions with zero signatures."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:10:12.038Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/multiversx/mx-multisig-and-modules"
},
{
"url": "https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-106511",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-106511"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-106511",
"datePublished": "2026-10-06T18:52:33.825Z",
"dateReserved": "2026-10-06T18:47:59.209Z",
"dateUpdated": "2026-10-07T17:55:09.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82988 (GCVE-0-2026-82988)
Vulnerability from cvelistv5 – Published: 2026-10-05 23:14 – Updated: 2026-10-06 13:13
VLAI
EPSS
VEX
Title
CVE-2026-82988
Summary
There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:12 UTC
CWE
- CWE-287 Improper Authentication
- CWE-434 Unrestricted Upload of File with Dangerous Type
- CWE-502 Deserialization of Untrusted Data
- CWE-287 - Improper Authentication
- CWE-434 - Unrestricted Upload of File with Dangerous Type
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82988",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:12:32.814466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:13:22.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vCast",
"vendor": "Viewsonic",
"versions": [
{
"lessThanOrEqual": "v3.2.715",
"status": "affected",
"version": "v0.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-287 Improper Authentication",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T23:14:28.183Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/"
},
{
"url": "https://kb.cert.org/vuls/id/234131"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-82988",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82988"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-82988",
"datePublished": "2026-10-05T23:14:28.183Z",
"dateReserved": "2026-08-31T15:22:24.690Z",
"dateUpdated": "2026-10-06T13:13:22.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82989 (GCVE-0-2026-82989)
Vulnerability from cvelistv5 – Published: 2026-10-05 23:14 – Updated: 2026-10-06 14:08
VLAI
EPSS
VEX
Title
CVE-2026-82989
Summary
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:06 UTC
CWE
- CWE-147 Improper Neutralization of Input During Web Page Generation (“Input Injection”)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-147 - Improper Neutralization of Input Terminators
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
2 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82989",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:06:46.321838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-147",
"description": "CWE-147 Improper Neutralization of Input Terminators",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:08:03.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vCast",
"vendor": "Viewsonic",
"versions": [
{
"lessThanOrEqual": "v3.2.715",
"status": "affected",
"version": "v0.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-147 Improper Neutralization of Input During Web Page Generation (\u201cInput Injection\u201d)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T23:14:14.325Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/"
},
{
"url": "https://kb.cert.org/vuls/id/234131"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-82989",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82989"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-82989",
"datePublished": "2026-10-05T23:14:14.325Z",
"dateReserved": "2026-08-31T15:22:36.481Z",
"dateUpdated": "2026-10-06T14:08:03.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104056 (GCVE-0-2026-104056)
Vulnerability from cvelistv5 – Published: 2026-10-01 18:03 – Updated: 2026-10-05 18:21
VLAI
EPSS
VEX
Title
CVE-2026-104056
Summary
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 18:21 UTC
CWE
- CWE-345 Insufficient Verification of Data Authenticity
- CWE-346 Origin Validation Error
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
- CWE-345 - Insufficient Verification of Data Authenticity
- CWE-346 - Origin Validation Error
- CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104056",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T18:21:10.671606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:21:14.480Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://uziii2208.github.io/post/cve-2026-104056/"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Authlib",
"vendor": "Authlib",
"versions": [
{
"status": "affected",
"version": "1.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-346 Origin Validation Error",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:03:27.484Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://uziii2208.github.io/post/cve-2026-104056/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-104056",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-104056"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-104056",
"datePublished": "2026-10-01T18:03:27.484Z",
"dateReserved": "2026-10-01T18:01:19.689Z",
"dateUpdated": "2026-10-05T18:21:14.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96760 (GCVE-0-2026-96760)
Vulnerability from cvelistv5 – Published: 2026-09-28 19:37 – Updated: 2026-10-01 13:58
VLAI
EPSS
VEX
Title
Authlib library contains a signature‑verification bypass vulnerability
Summary
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 13:57 UTC
CWE
- CWE-347 Improper Verification of Cryptographic Signature
- CWE-670 Always-Incorrect Control Flow Implementation
- CWE-358 Improperly Implemented Security Check for Standard
- CWE-20 Improper Input Validation
- CWE-347 - Improper Verification of Cryptographic Signature
- CWE-670 - Always-Incorrect Control Flow Implementation
- CWE-358 - Improperly Implemented Security Check for Standard
- CWE-20 - Improper Input Validation
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-28T20:07:57.835Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/762428"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-96760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T13:57:45.534196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-670",
"description": "CWE-670 Always-Incorrect Control Flow Implementation",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-358",
"description": "CWE-358 Improperly Implemented Security Check for Standard",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T13:58:32.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Authlib",
"vendor": "Authlib",
"versions": [
{
"status": "affected",
"version": "1.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-670 Always-Incorrect Control Flow Implementation",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-358 Improperly Implemented Security Check for Standard",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-20 Improper Input Validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T19:37:58.973Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/authlib/authlib"
},
{
"url": "https://kb.cert.org/vuls/id/762428"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authlib library contains a signature\u2011verification bypass vulnerability",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-96760"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-96760",
"datePublished": "2026-09-28T19:37:58.973Z",
"dateReserved": "2026-09-23T15:59:27.145Z",
"dateUpdated": "2026-10-01T13:58:32.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18311 (GCVE-0-2026-18311)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:27 – Updated: 2026-09-25 16:58
VLAI
EPSS
VEX
Title
CVE-2026-18311
Summary
Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:58 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/699627 |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-18311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:58:10.634438Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:58:34.254Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reader",
"vendor": "Readwise",
"versions": [
{
"lessThanOrEqual": "8.10.1",
"status": "affected",
"version": "8.7.2",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-116",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:27:54.187Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/699627"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-18311",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18311"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-18311",
"datePublished": "2026-09-25T16:27:54.187Z",
"dateReserved": "2026-07-29T17:36:03.706Z",
"dateUpdated": "2026-09-25T16:58:34.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18320 (GCVE-0-2026-18320)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:27 – Updated: 2026-09-25 16:57
VLAI
EPSS
VEX
Title
CVE-2026-18320
Summary
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:56 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/699627 |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-18320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:56:55.358504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:57:42.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reader",
"vendor": "Readwise",
"versions": [
{
"lessThan": "8.10.1",
"status": "affected",
"version": "8.7.2",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., \u0027onload\u0027, \u0027onerror\u0027). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-625",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:27:37.419Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/699627"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-18320",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18320"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-18320",
"datePublished": "2026-09-25T16:27:37.419Z",
"dateReserved": "2026-07-29T18:50:43.819Z",
"dateUpdated": "2026-09-25T16:57:42.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18312 (GCVE-0-2026-18312)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:27 – Updated: 2026-09-25 16:56
VLAI
EPSS
VEX
Title
CVE-2026-18312
Summary
Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:56 UTC
CWE
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-116 Improper Encoding or Escaping of Output
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.cert.org/vuls/id/699627 |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-18312",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:56:09.413897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:56:33.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reader",
"vendor": "Readwise",
"versions": [
{
"lessThanOrEqual": "8.10.1",
"status": "affected",
"version": "8.7.2",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:27:28.079Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/699627"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-18312",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18312"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-18312",
"datePublished": "2026-09-25T16:27:28.079Z",
"dateReserved": "2026-07-29T17:45:56.191Z",
"dateUpdated": "2026-09-25T16:56:33.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75907 (GCVE-0-2026-75907)
Vulnerability from cvelistv5 – Published: 2026-09-24 15:56 – Updated: 2026-09-24 18:01
VLAI
EPSS
VEX
Title
CVE-2026-75907
Summary
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 18:01 UTC
CWE
- CWE-287 Improper Authentication
- CWE-294 Authentication Bypass by Capture-replay
- CWE-613 Insufficient Session Expiration
- CWE-287 - Improper Authentication
- CWE-294 - Authentication Bypass by Capture-replay
- CWE-613 - Insufficient Session Expiration
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Norwegian Cruise Line | door access control |
Affected:
N/A
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-24T17:07:43.376Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/676317"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-75907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T18:01:05.357661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:01:38.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "door access control",
"vendor": "Norwegian Cruise Line",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The door access control on a Norwegian Cruise Line asset grants entry based only on the credential\u0027s static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-287 Improper Authentication",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-613 Insufficient Session Expiration",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:56:08.200Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/676317"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-75907",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-75907"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-75907",
"datePublished": "2026-09-24T15:56:08.200Z",
"dateReserved": "2026-08-18T14:59:09.975Z",
"dateUpdated": "2026-09-24T18:01:38.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82356 (GCVE-0-2026-82356)
Vulnerability from cvelistv5 – Published: 2026-09-23 18:25 – Updated: 2026-09-24 14:37
VLAI
EPSS
VEX
Title
Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
Summary
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 14:37 UTC
CWE
- CWE-326 Inadequate Encryption Strength
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
- CWE-326 - Inadequate Encryption Strength
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Imprivata | Imprivata Enterprise Access Management |
Affected:
0.0.0 , ≤ 26.2.6
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-23T19:06:58.517Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/273940"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T14:37:07.114927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-327",
"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:37:39.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Imprivata Enterprise Access Management",
"vendor": "Imprivata",
"versions": [
{
"lessThanOrEqual": "26.2.6",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Imprivata EAM \u003c=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:25:22.672Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/273940"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82356"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-82356",
"datePublished": "2026-09-23T18:25:22.672Z",
"dateReserved": "2026-08-28T18:04:06.099Z",
"dateUpdated": "2026-09-24T14:37:39.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86867 (GCVE-0-2026-86867)
Vulnerability from cvelistv5 – Published: 2026-09-23 17:44 – Updated: 2026-09-24 14:37
VLAI
EPSS
VEX
Title
Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers
Summary
Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester's `user_id` to the conversation's owner `Conversation.user`. This allows any authenticated user to perform the following actions:
1. Read other user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions.
2. Permanently delete another user's conversation.
3. Rename another user's conversation.
4. Overwrite another user's conversation's chat suggestion list.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 14:37 UTC
CWE
- CWE-862 Missing Authorization
- CWE-639 Authorization Bypass Through User-Controlled Key
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-862 - Missing Authorization
- CWE-639 - Authorization Bypass Through User-Controlled Key
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cinnamon AI | Kotaemon |
Affected:
0.12.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-23T18:10:51.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/754548"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T14:37:13.797147Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:37:20.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Kotaemon",
"vendor": "Cinnamon AI",
"versions": [
{
"status": "affected",
"version": "0.12.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cinnamon\u0027s Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester\u0027s `user_id` to the conversation\u0027s owner `Conversation.user`. This allows any authenticated user to perform the following actions:\r\n1. Read other user\u0027s chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions.\r\n2. Permanently delete another user\u0027s conversation.\r\n3. Rename another user\u0027s conversation.\r\n4. Overwrite another user\u0027s conversation\u0027s chat suggestion list."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T17:44:52.482Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://kb.cert.org/vuls/id/754548"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cinnamon\u0027s kotaemon contains improper authorization checks in multi\u2011user chat handlers",
"x_generator": {
"engine": "VINCE 3.0.49",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-86867"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-86867",
"datePublished": "2026-09-23T17:44:52.482Z",
"dateReserved": "2026-09-08T16:29:11.518Z",
"dateUpdated": "2026-09-24T14:37:20.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}