Threat database

CVE-2026-109612 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext affecting versions before 15.120.0 and 16.x before 16.33.0. The flaw occurs in a report view that inserts stored record names into web page markup without proper escaping. Authenticated users who can create records may exploit this by embedding malicious scripts in record names, which execute in the browsers of users viewing the report.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits.

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.

CVE-2026-109609 is an SQL injection vulnerability in Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0. Authenticated users with low privileges can exploit insufficient input validation in certain endpoints to inject SQL commands and extract sensitive database information. The vulnerability has a high severity with a CVSS score of 7.1.

CVE-2026-109608 is a high-severity SQL injection vulnerability in Frappe ERPNext affecting versions before 15.121.0 and 16.x before 16.34.0. It allows any authenticated user, even those without assigned roles, to send specially crafted requests to certain endpoints lacking input validation. Exploitation can lead to unauthorized reading of sensitive user information and privilege escalation to a higher-level account.

CVE-2026-109604 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext. It affects versions before 15.112.0 and 16.x before 16.23.0. The flaw arises because a tool view interpolates stored record names into web page markup without proper escaping. An authenticated user who can create records with malicious names can execute scripts in the sessions of users who later view those records. This vulnerability has a high severity score of 8.5.

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.

Hugo versions from 0.162.0 up to but not including 0.167.0 contain an improper link resolution vulnerability. This flaw allows malicious themes or modules to expose files outside their intended root directory by exploiting nested-mount ancestor directories. Attackers controlling a theme can place symbolic links or NTFS junctions at virtual ancestor directories, causing Hugo to list and publish local files during site builds.

Hugo versions from 0.84.0 up to but not including 0.167.0 contain a path traversal vulnerability. This flaw allows malicious themes or modules to read files outside the project root directory by exploiting ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can use relative imports or symlinks pointing outside the project to include any file readable by the build user into the generated JavaScript or CSS output.

CVE-2026-109574 is a path traversal vulnerability in the Hugo static site generator before version 0.167.0. It affects the Sass compiler's import fallback mechanism, allowing malicious themes or modules to read files outside the project root by using crafted @import or @use statements. This can lead to unauthorized disclosure of files by compiling their contents into the published CSS output.

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

CVE-2025-71432 is a reflected cross-site scripting (XSS) vulnerability in Frappe ERPNext. It affects versions before 14.92.1 and 15.x before 15.83.0. The vulnerability arises from improper input validation on a certain page, allowing attackers to inject arbitrary JavaScript. Exploitation requires a logged-in user to open a crafted URL, potentially leading to account takeover.

CVE-2026-108935 is a cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC router firmware version 1.32. The flaw exists in the Port Forwarding Page component, specifically in the /goform/formPortFw file. An attacker can remotely exploit this vulnerability to execute malicious scripts. The vendor was contacted but did not respond, and no patch or remediation information is available. The vulnerability has a CVSS 4.8 (medium) severity score.

A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NangoHQ nango versions prior to 0.70.9 contain a missing authorization vulnerability (CWE-862) in two private flow-read API routes. On accounts with RBAC enabled, users with the development_full_access role can bypass production role boundaries within the same tenant and read production integration flow metadata or named flow configurations. This issue does not allow cross-tenant access. The vulnerability is fixed in version 0.70.9.

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.

CVE-2026-108933 is a cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC router firmware version 1.32. The vulnerability exists in an unspecified function within the /goform/formFilter file. It allows remote attackers to execute XSS attacks. The vendor was notified but has not responded or provided a fix. Exploit code is publicly available, but no active exploitation in the wild has been reported. The CVSS 4.0 base score is 4.8, indicating a medium severity.

CVE-2026-90911 is a high-severity vulnerability in IBM Maximo AI Service versions 9.1.0 and 9.2.0. It involves uncontrolled resource consumption that could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a vulnerability involving uncontrolled recursion that can be triggered remotely, leading to a denial of service condition. This flaw does not impact confidentiality or integrity but can cause service unavailability. The vulnerability is identified as CWE-674 and has a CVSS 3.1 score of 7.5, indicating high severity. No patch or remediation details are currently provided, and there are no known exploits in the wild.

IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a critical vulnerability (CVE-2026-90920) involving improper control of code generation, which could allow a remote attacker to execute arbitrary code without authentication.