Threat database

Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

CVE-2026-94171 is a high-severity DOM-based Cross-site Scripting (XSS) vulnerability in VillaTheme CURCY woo-multi-currency plugin version 2.2.18 and earlier. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability impacts confidentiality, integrity, and availability of affected systems. No official patch or remediation information is provided in the available data.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

The MediaWiki PageTriage extension versions 1.43, 1.45, and 1.46 contain a vulnerability that exposes sensitive information through data queries. This issue is classified under CWE-202, which involves exposure of sensitive information through data queries. The vulnerability has a low severity rating and a CVSS 4.0 score of 1.2. There is no indication of known exploits in the wild or available patches at this time.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikbase extension versions 1.43, 1.45, and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, classified as CWE-80. It allows an attacker to inject script code into web pages, potentially impacting users with high privileges who interact with the affected extension. The vulnerability has a low CVSS score of 0.3 and no known exploits in the wild.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikistories extension versions 1.43, 1.45, and 1.46. The issue is due to improper neutralization of script-related HTML tags, which can allow script injection in web pages. This vulnerability is identified as CWE-80. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

CVE-2026-103471 is a high-severity vulnerability in Corvusoft restbed up to version 5.0.0 where HTTP request headers are buffered without a maximum size limit. This allows remote unauthenticated attackers to exhaust server memory by opening TCP connections and streaming bytes indefinitely without sending the header delimiter, causing unbounded heap memory allocation until the server process is terminated.

A reflected cross-site scripting (XSS) vulnerability exists in the MediaWiki ReadingLists extension versions 1.45 and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, which can allow an attacker to inject malicious scripts into web pages. The issue has a low severity rating and a CVSS 4.0 score of 1.1. No official patch or remediation guidance has been provided yet.

Kobako is a Ruby gem embedding a Wasm-isolated mruby interpreter to safely execute untrusted Ruby scripts. Versions from 0.1.0 up to but not including 0.9.1 contain a vulnerability allowing guest scripts to escape the sandbox and execute arbitrary Ruby code in the host process. This vulnerability is identified as CVE-2026-55107 and has been patched in version 0.9.1.

A stored cross-site scripting (XSS) vulnerability exists in the MediaWiki Page_Forms extension maintained by The Wikimedia Foundation. The flaw is due to improper neutralization of script-related HTML tags, allowing malicious scripts to be stored and executed in the context of affected web pages. This vulnerability affects specific versions 1.43, 1.45, and 1.46 of the extension. The CVSS 4.0 base score is low, indicating limited impact and exploitability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.decode(). This skips signature verification, audience (aud) validation, issuer (iss) validation, and expiry (exp) checking entirely. The extracted claims (email/sub/preferred_username) are then used directly as the user_id for the resulting Tugtainer session. This issue has been patched in version 1.31.3.

A local privilege escalation vulnerability exists in the Gigabyte BIOS utility kernel driver GVCIDrv64.sys. The driver exposes device interfaces with no access control, allowing any local user to perform arbitrary physical memory read/write and I/O port access. This enables an attacker to escalate privileges by manipulating process tokens and spawning a system shell. Gigabyte has removed the vulnerable driver and replaced it with a new driver in a later utility version.

CVE-2026-62308 is a critical server-side request forgery (SSRF) vulnerability in Quenary's Tugtainer, a self-hosted app for automating Docker container updates. Versions prior to 1.30.6 allow authenticated users to make the backend server send HTTP requests to arbitrary URLs via the /settings/test_notification endpoint. This endpoint does not restrict protocols, hostnames, localhost, private IP ranges, or cloud metadata addresses, enabling blind SSRF attacks. The vulnerability has been patched in version 1.30.6.

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns successfully if Config.AGENT_SECRET is empty. This causes protected Agent APIs to become accessible without authentication. This issue has been patched in version 1.30.4.

Tugtainer versions prior to 1.30.3 have an improper access control vulnerability where the OIDC authentication flow can be initiated even when OIDC is disabled via configuration. Although the /auth/oidc/enabled endpoint correctly reports OIDC as disabled, a direct request to /auth/oidc/login bypasses this setting, starting the OIDC login flow and redirecting users to the OIDC authorization endpoint. This issue has been fixed in version 1.30.3.

CVE-2026-103241 is a denial of service vulnerability in the vllm-project vLLM software affecting versions 0.1 through 0.26.0. The flaw exists in the Gemma4UnifiedParser component within the rust/src/parser/src/unified/gemma4.rs file. An attacker can remotely trigger this vulnerability to cause a denial of service. A patch is available in version 0.29.1rc0, which addresses this issue.

CVE-2026-55176 is a critical authorization vulnerability in Soft Machine versions 0.2.247 and earlier. The flaw exists in two authentication helper functions that accept a global shared secret as a bearer token without verifying the caller's workspace. This allows any tenant to use the shared secret to access and manipulate other tenants' workspace APIs, leading to cross-workspace read, write, and destructive restore capabilities. No patches are publicly known at the time of publication.

CVE-2026-103233 is an authorization bypass vulnerability in the Admin Area of the AdithyaYelloju Restaurant-Management-System. It affects versions up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The flaw involves manipulation of the ID argument in the /admin/ component, allowing remote attackers to bypass authorization controls. The vulnerability has been publicly disclosed, but no patch or vendor response has been reported yet.