CVE-2026-105643 is a cross-site scripting (XSS) vulnerability in the Ghost blogging platform affecting versions from 6.34.0 up to but not including 6.67.0. The flaw allows any staff user, including Contributors, to embed scripts in post content that execute when another staff user opens the post in the editor, potentially compromising the admin session of that user. The issue arises from improper neutralization of input during web page generation related to embed cards in the Ghost editor. The vulnerability has been fixed in version 6.67.0.
CVE-2026-105387 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects the Patient Login Handler component, specifically the mysqli_query function in cover.php, allowing remote attackers to manipulate the uname/psw parameters to execute SQL injection. The vulnerability is publicly known and exploit code has been released. The product uses rolling releases, so exact affected and fixed versions are not available. The vendor has not yet responded or provided a fix.
CVE-2026-28648 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, and 16-qpr2. It involves a permission bypass in the Settings component due to a confused deputy issue, allowing local attackers to escalate privileges without needing additional execution rights or user interaction.
CVE-2026-28647 is a high severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, and 16-qpr2. It stems from a logic error in the updateState function of DeviceAdminAppsPreferenceController.java, allowing a local attacker to bypass permissions and escalate privileges without requiring user interaction.
CVE-2026-28641 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, and 16-qpr2. It arises from a logic error in the shouldDisableUninstallButton method of ApplicationActionButtonsPreferenceController.java, allowing a local attacker to bypass permission checks and escalate privileges without requiring user interaction.
CVE-2026-28640 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, and 16. It arises from improper input validation in the checkCallerIsCertInstallerOrSelfInProfile function of CredentialStorageActivity.java, allowing a local attacker to bypass permissions and escalate privileges without requiring additional execution privileges or user interaction.
CVE-2026-28625 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It arises from a logic error causing possible permission bypass in multiple code locations, allowing local attackers to escalate privileges without needing additional execution rights or user interaction.
CVE-2026-104714 is a race condition vulnerability in Apache Struts affecting versions from 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The flaw occurs when localized messages format date or time arguments using a shared formatter without proper synchronization, leading to potential data leakage between users or server errors. Versions 6.12.0 and 7.4.0 include fixes for this issue.
CVE-2026-104713 is a resource allocation vulnerability in the Apache Struts REST plugin. The plugin reads request bodies into memory without limiting their size, allowing a single request to consume excessive Java heap memory. This can lead to denial of service by exhausting server resources. The vulnerability affects multiple Apache Struts versions, and fixed versions are available.
CVE-2026-104712 is an asymmetric resource consumption vulnerability in Apache Struts affecting versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The flaw occurs when a request parameter bound to a BigDecimal property is rendered via the Struts tag library, causing the response size to amplify significantly. This allows an unauthenticated attacker to exhaust server CPU and network resources with low-volume traffic. Upgrading to Apache Struts versions 6.12.0 or 7.4.0 mitigates the issue.
CVE-2026-104711 is a critical vulnerability in Apache Struts involving improper neutralization of special elements in expression language statements, leading to expression language injection. This flaw affects applications configured to use the legacy RESTful action mapper, allowing crafted requests to inject OGNL expressions that may result in remote code execution. Struts 7 is vulnerable only if the OGNL allowlist is disabled, which is not the default setting. Other action mappers and the Struts REST plugin are not affected. The vulnerability impacts multiple Struts versions from 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Upgrading to versions 6.12.0 or 7.4.0 addresses the issue.
A stored cross-site scripting (XSS) vulnerability exists in the GhozyLab Image Slider Widget up to version 1.1.130. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A SQL injection vulnerability exists in the onetwothreeneth HospitalManagementSystem in the file transaction_details.php via manipulation of the transaction_id parameter. The vulnerability can be exploited remotely without authentication. The project uses a rolling release system, so affected or fixed versions are not disclosed. The issue was reported but not yet addressed by the vendor. The vulnerability has a CVSS score of 7.3, indicating a medium severity level.
A reflected cross-site scripting (XSS) vulnerability exists in Jose Fernandez Adsmonetizer adsensei-b30 through version 3.2.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of a victim's browser. The vulnerability has a high severity rating with a CVSS score of 7.1.
A cross-site scripting (XSS) vulnerability exists in Quay where an attacker can craft a malicious login link that causes execution of arbitrary scripts in the victim's browser session. This occurs because the application does not validate redirect destinations after login. Exploitation requires the Quay deployment to use direct database authentication and the victim to complete login via the malicious URL. The vulnerability has a medium severity score of 4.2 CVSS v3.1.
A vulnerability exists in onetwothreeneth HospitalManagementSystem affecting the update_subaccount function in the Account Administration component. The flaw involves improper authorization due to manipulation of the user_id argument, allowing remote exploitation. The product uses a rolling release model, so specific affected or fixed versions are not provided. The issue was reported early but has not yet received a vendor response or patch. The CVSS score is 7.3, indicating a medium severity risk.
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos account. The task took the address to fetch from the request without checking it and asked for no form token. A prepared page on another web site could therefore make the server send the access token of the account to any address, or fetch addresses inside the server's network, in the name of a logged in administrator; a back-end user with the permission "Manage" could do the same directly. The token is valid for about an hour and reaches what the picker session of the account reaches.
A vulnerability in all versions of dormakaba evolo Service allows remote attackers to execute arbitrary code with SYSTEM privileges via a .NET component. This issue enables full system compromise if exploited.
A missing authorization vulnerability exists in the Joomla extension TF Content versions 2.9.0 through 2.9.4. The extension's public RecordController allows unauthenticated users to create and edit records without proper permission checks. Attackers can use a valid token from Joomla's public login form to modify any TF Content record, including sensitive fields such as published status, access level, and creator ID.