CVE-2026-90913 is a high severity vulnerability in Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It involves improper access control checks on webservice endpoints related to access levels, allowing unauthorized users with certain privileges to perform mutation actions. This flaw affects the core Joomla! CMS and could lead to unauthorized modifications via these endpoints.
A cross-site scripting (XSS) vulnerability exists in Joomla! CMS versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. The issue arises from improper escaping in the HTMLHelper::link method, which can lead to injection of malicious scripts during web page generation.
A stored Cross-site Scripting (XSS) vulnerability exists in the Wikimedia Foundation Mediawiki Wikibase Extension. It involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This affects multiple versions of the Wikibase Extension prior to 1.46.1, 1.45.5, and 1.43.10. No CVSS score or official patch status is currently available, and no active exploitation has been reported.
A vulnerability in the Wikimedia Foundation Mediawiki CentralAuth Extension allows unauthorized exposure of sensitive information. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10. There is no detailed technical information or confirmed patch status available. The vulnerability is categorized as high severity due to the exposure of sensitive data.
A stored Cross-site Scripting (XSS) vulnerability exists in the Wikimedia Foundation Mediawiki WikiSEO Extension. This vulnerability arises from improper neutralization of input during web page generation, which allows malicious scripts to be stored and executed in users' browsers. It affects versions prior to 1.46.1, 1.45.5, and 1.43.10 of the WikiSEO Extension. No official patch or vendor advisory is currently available.
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.
A stored cross-site scripting (XSS) vulnerability exists in the Wikimedia Foundation Mediawiki Flow Extension due to improper input neutralization during web page generation. This allows malicious scripts to be stored and executed in users' browsers. The vulnerability affects versions prior to 1.46.1, 1.45.5, and 1.43.10 of the Flow Extension. No CVSS score or detailed vendor advisory is available.
A vulnerability in the Wikimedia Foundation Mediawiki EventBus Extension version 1.47.0-alpha allows unauthorized actors to access sensitive information. This exposure is classified under CWE-200, indicating information disclosure. No patch or remediation guidance is currently available, and no CVSS score has been assigned. The vulnerability is considered high severity based on the nature of the exposure.
CVE-2026-92370 is an improper access control vulnerability in TeamViewer Full Client, Host, and related modules on Windows, Linux, and macOS. It allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. This enables the attacker to modify access control parameters for restricted features and perform unauthorized actions, potentially leading to remote code execution on the target system. The vulnerability has a high severity with a CVSS score of 8.8. No patch information is provided in the available data.
TeamViewer Full Client and Host versions prior to 15.82 on Windows have a time-of-check to time-of-use (TOCTOU) race condition in the installer rollback mechanism. This vulnerability allows a local low-privileged attacker to replace rollback backup files in a user-writable temporary directory before they are restored by an elevated installer, potentially escalating privileges to NT AUTHORITY/SYSTEM. Exploitation requires precise timing of the race condition during an installation or update rollback.
TeamViewer Full Client and Host for Linux versions prior to 15.82 contain an improper path validation vulnerability in the Cloud Session Recording feature. This vulnerability arises from a race condition during path validation and file access, allowing a local authenticated attacker to perform privileged file operations in unintended locations on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. No explicit patch information is provided in the available data.
UnoPim versions before 2.0.1 and 2.1.1 improperly trust all connecting clients as proxies and accept the X-Forwarded-Host header without validation. This flaw allows unauthenticated attackers to inject arbitrary origins into admin layout pages. By setting the X-Forwarded-Host header, attackers can redirect JavaScript asset loading to their own servers. When responses are cached by shared proxies, subsequent administrators may unknowingly execute attacker-supplied code within their authenticated sessions.
CVE-2026-102825 is a vulnerability in the Eugeny russh Rust SSH client and server library where authentication attempt limits are not properly enforced prior to version 0.62.6. This allows an unauthenticated remote client to bypass the configured maximum authentication attempts on a single connection, potentially increasing the risk of online guessing attacks and additional backend workload. The issue is fixed in version 0.62.6.
CVE-2026-102824 affects the Eugeny russh Rust SSH client and server library prior to version 0.63.0. The vulnerability arises from the hybrid ML-KEM 768 and X25519 key exchange implementation accepting an all-zero 32-byte peer X25519 public key. This causes the X25519 contribution to the combined shared secret to be zero, allowing a malicious peer to force the shared secret to depend solely on ML-KEM. This defeats the intended fallback protection of the hybrid exchange. The issue is fixed in russh version 0.63.0.
CVE-2026-102823 is an improper input validation vulnerability in the Eugeny russh Rust SSH client and server library. Versions prior to 0.63.1 do not verify that channel lifecycle events received from an SSH server correspond to channels the client actually opened and established. This allows a malicious SSH server to send events for predicted or invalid channel identifiers, potentially causing application panics or corrupting command completion and exit-code tracking. The issue is fixed in version 0.63.1.
A vulnerability in adm-zip version 0.6.0 allows bypassing decompression-bomb protection by setting the declared uncompressed size in a ZIP entry to zero. This causes the decompression output size limit to be ignored, potentially leading to excessive memory allocation and process crashes. The issue arises because the decompression cap is only applied when the declared size is greater than zero. A patch is available to address this flaw.
Nodemailer versions up to 10.0.1 improperly handle deeply nested recipient arrays in fields like to, cc, and bcc. This flaw causes a stack exhaustion denial-of-service (DoS) when processing such inputs, leading to a RangeError and potential termination of the Node.js process. The vulnerability arises because only the outermost array is flattened before passing nested arrays to a parser that converts them to strings recursively, exhausting the V8 call stack. No SMTP server or successful email delivery is required to trigger this. The issue is fixed in version 10.0.2.
CVE-2026-102822 is a low-severity vulnerability in the Russh Rust SSH client and server library prior to version 0.63.1. It involves improper validation of array indices when a connection is configured to permit mac=none but negotiates a MAC-requiring cipher. This can cause a panic and termination of the connection task due to an out-of-bounds slice operation. The issue is fixed in version 0.63.1.
CVE-2026-102821 is an uncontrolled resource consumption vulnerability in the Eugeny russh Rust SSH client and server library. Versions prior to 0.63.2 allow an authenticated remote peer to flood SSH_MSG_CHANNEL_OPEN messages without sending the required SSH_MSG_KEX_ECDH_INIT, causing the server to enqueue replies on an unbounded channel. This leads to memory growth until the process is terminated. The issue is fixed in version 0.63.2.
CVE-2026-102820 is an out-of-bounds read vulnerability in the Windows pageant crate used by Eugeny's russh library. The flaw exists in the MemoryMap::read function prior to pageant version 0.2.3, where a peer-controlled 32-bit response length is trusted, allowing a local process impersonating the Pageant window to cause a large memory allocation and read beyond the mapped memory. This can crash the russh client and potentially expose adjacent committed memory. The issue is fixed in pageant 0.2.3.