A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
A cluster of 31 Russian-language Chrome extensions masquerading as VPN services for blocked platforms like RuTracker, YouTube, Telegram, Instagram, ChatGPT, and Netflix shares a single malicious codebase. Published from three linked Google accounts, these extensions collectively affect approximately 356,000 users, with the flagship RuTracker VPN extension holding 200,000 installations. The extensions request extensive proxy permissions and dynamically fetch proxy server configurations from remote sources including GitHub Pages, Blogspot, Google Docs, and Telegram channels after installation. This architecture allows operators to modify traffic routing without pushing updates. The configuration uses obfuscated server lists with shared credentials and offers a paid VIP tier for 299 roubles. Some proxy hostnames match those used by Browsec VPN premium servers, suggesting a potential operational connection.
CVE-2026-86158 is a high-severity vulnerability in Progress Software's Telerik Fiddler Everywhere version 1.0.0 up to but not including 8.2.0. It involves missing authentication in the local .NET backend component (Fiddler.WebUi), allowing a local unauthenticated attacker to mint OAuth tokens and access the machine-in-the-middle root certificate via unauthenticated localhost HTTP and SignalR RPC channels.
CVE-2026-86157 is a vulnerability in Progress Telerik Fiddler Everywhere before version 8.2.0 that exposes privileged inter-process communication (IPC) functionality. A local attacker with low privileges who can alter application launch parameters and convince a user to start the application may replace the UI or settings with attacker-controlled content. This can lead to disclosure of OAuth tokens, execution of local programs, or unauthorized changes to configuration files.
Multiple vulnerabilities have been identified in the Image Scanner Driver for Linux provided by PFU Limited. Specific technical details and affected versions are not disclosed in the available information. No known exploits are reported in the wild at this time.
CVE-2026-102293 is a medium severity vulnerability in realjerrytang tacomall version 1.0.0. It involves improper authorization in the OrgStaffServiceImpl.add function within the api-admin Backend component. The vulnerability arises from manipulation of the isAdmin and jobId arguments, allowing unauthorized actions. Remote exploitation is possible, and public exploit code exists.
A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 6406308df9771d2fd477b56dafe4878dd846df6e. Applying a patch is the recommended action to fix this issue.
Multiple vulnerabilities have been identified in Pgpool-II, a software provided by the Pgpool Global Development Group. Specific details about the nature of these vulnerabilities, affected versions, or exploitation methods have not been disclosed.
A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-102264 is a cross-site scripting (XSS) vulnerability in the mwasikz robo-cafe-rms product affecting the Edit Profile feature in frontend/update-account.php. It allows remote attackers to inject malicious scripts via manipulation of the Name, Address, or City parameters. The vulnerability has a medium severity score of 5.1 and an exploit has been publicly disclosed. The vendor has not responded to the disclosure and no patch or fixed versions have been provided due to the product's rolling release model.
CVE-2026-97029 is a vulnerability in Flatpak's process ID namespace separation on Red Hat Enterprise Linux 10. It allows a sandboxed Flatpak application to send kill signals to processes outside its sandbox that share the same process group, potentially causing denial of service by terminating critical processes such as the desktop shell. The vulnerability has a medium severity with a CVSS score of 5.7.
CVE-2026-102414 is a medium severity vulnerability in the browserify pbkdf2 library up to version 3.1.6. It involves uncontrolled resource consumption due to re-hashing of passwords longer than the digest's block size on every iteration in the JavaScript fallback implementation. This causes a computational cost proportional to the product of iterations and password length, potentially blocking the event loop. The issue affects Node.js versions before 0.12, Bun versions 1.0.0 through 1.1.34 and 1.2.6 and later, and Deno 2.9.0 and later when the fallback is used. Node.js 0.12 and later and browser builds are not affected. Applications that enforce reasonable maximum password lengths are not significantly impacted.
A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-food.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.
CVE-2026-102422 is a high-severity OS command injection vulnerability in the shell-quote library's quote() function. The vulnerability arises because comment tokens emitted as # followed by text can comment out the rest of a shell line, allowing line terminators in subsequent string tokens to end the comment and cause unintended shell command execution. This affects versions from 1.8.4 up to but not including 1.11.0. The issue was fixed in version 1.11.0 by making quote() throw a TypeError when a string after a comment token contains a line terminator.
CVE-2026-102249 is a medium severity vulnerability in REBUILD up to version 4.4.11. It involves missing authorization checks in the /commons/file-editor-save endpoint due to manipulation of the url/fileKey argument. This flaw allows remote attackers to exploit the system without authentication. Public exploit code is available, but no vendor response or patch has been provided.
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.