A cross-site scripting (XSS) vulnerability was identified in lichess-org's lila platform prior to a specific commit. The flaw allowed a user with permission to add a chapter to a study to inject attacker-controlled HTML and CSS via the PGN Annotator tag, which was rendered without proper escaping in the study's comments. Although the site's content security policy blocks injected JavaScript, the vulnerability could enable navigation to attacker-controlled sites, content spoofing, and CSS-based data exposure. This issue was fixed by a commit that properly escapes the injected content.
CVE-2026-110536 is a critical OS command injection vulnerability in the D-Link DIR-868L router firmware version 2.01b05. It affects the HNAP CGI Handler component, specifically the system function in /htdocs/cgibin, where manipulation of the SOAPACTION argument can lead to remote command execution. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity. Exploit code has been publicly disclosed, but there are no known exploits in the wild at this time. No patch or remediation information is provided.
CVE-2026-55573 is a critical deserialization vulnerability in the e107 content management system prior to version 2.3.7. The vulnerability exists in install.php, which unserializes attacker-controlled data without restricting allowed classes, enabling unauthenticated remote code execution. This flaw allows an attacker to execute arbitrary PHP functions with the web server's privileges, potentially leading to full server compromise. The issue is fixed in version 2.3.7.
CVE-2026-55572 is a critical SQL injection vulnerability in the e107 content management system's alt_auth plugin prior to version 2.3.7. The flaw arises from improper sanitization of usernames in SQL queries within the otherdb and e107db authentication backends. This allows unauthenticated attackers to inject arbitrary SQL commands when the alt_auth plugin is configured with an active external database connection. The vulnerability can lead to data exposure, unauthorized data modification, and error messages that reveal query details. The issue is resolved in e107 version 2.3.7.
CVE-2026-102476 is a critical vulnerability in Eclipse Vert.x HTTP client versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The issue arises because the SSL context cache key does not fully reflect the SSL properties, allowing a client to receive an SSL context with weaker security properties than requested, such as bypassing hostname validation.
CVE-2026-108484 is a stored cross-site scripting (XSS) vulnerability in the WPManageNinja Best Payments Plugin for WordPress. It affects versions from initial release up to 4.6.27. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The impact includes potential partial confidentiality, integrity, and availability loss. No patch or remediation information is provided in the available data.
CVE-2026-108483 is a high-severity reflected cross-site scripting (XSS) vulnerability in the hippooo Hippoo Mobile App for WooCommerce. It affects versions from initial releases up to and including 1.12.0. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can execute in the context of the victim's browser. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.
CVE-2026-105066 is a reflected cross-site scripting (XSS) vulnerability in SimplyRETS Real Estate IDX affecting versions from initial release up to 3.2.9. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-108151 is a medium severity vulnerability in the PluginUs.Net MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin that allows code injection due to improper control of code generation. It affects versions from 0 up to but not including 1.4.0. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only. No known exploits are reported in the wild, and no patch or remediation information is currently provided.
CVE-2026-103081 is a high-severity code injection vulnerability in VillaTheme Salevo woo-boost-sales plugin. It affects versions from initial release up to 1.3.0. The vulnerability allows an attacker to inject code due to improper control of code generation. The CVSS score is 7.5, indicating a network exploitable issue with high impact on confidentiality but no impact on integrity or availability. No known exploits are reported in the wild. No patch or remediation information is provided in the available data.
CVE-2026-104103 is a path traversal vulnerability in ludwig-ai's ludwig framework prior to version 0.17.8. The flaw exists in the extract_archive() function, which improperly validates symlink and hard-link members in tar archives, allowing crafted archives to write files outside the intended extraction directory. This can lead to attacker-controlled content being placed at arbitrary filesystem paths with the privileges of the extracting process. The issue affects Python 3.12 and 3.13 runtimes but not Python 3.14, which rejects such escaping links by default. The vulnerability is fixed in version 0.17.8.
A vulnerability in GNOME evolution-data-server allows unauthorized exposure of sensitive information. Calendar events with a file:// URI in their ATTACH property cause the client to read and base64-encode local files, then upload them to the server when the event is saved. There are no restrictions on file paths or verification of attachment origin, enabling attackers with access to a shared CalDAV calendar to exfiltrate arbitrary files accessible to the user. This affects versions from 3.26 up to but not including 3.62.1. The vulnerability has a medium severity score of 5.7.
Redash versions from 26.0.0 up to but not including 26.9.0 contain an improper access control vulnerability in the DuckDB query runner. This flaw allows users with query access to an administrator-created DuckDB data source to read or write files on the server with the privileges of the Redash process. Sensitive application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could be exposed, potentially enabling session forgery and authentication bypass. The issue is resolved in version 26.9.0.
ServiceNext SerTec version 1.00 contains an authorization bypass vulnerability (CWE-639) in the /api/Usuario/GetUsuarios endpoint. The endpoint accepts a user-controlled numeric ID without verifying that the authenticated user is authorized to access the requested account. This allows any authenticated user to retrieve full profile records of other users, including passwords stored in cleartext (CWE-256). This vulnerability enables account takeover and credential-stuffing attacks.
A Server-Side Request Forgery (SSRF) vulnerability exists in redash versions from 10.0.0 up to but not including 26.9.0. The JSON data source query runner improperly combines a configured base URL with a user-supplied query URL, allowing an absolute URL to override the base URL. This enables users with execute_query permission to make server-side requests to arbitrary external origins. If HTTP Basic Authentication is configured, credentials may be forwarded to these external origins. Private IP blocking can be enforced via REDASH_ENFORCE_PRIVATE_IP_BLOCK. The issue is fixed in version 26.9.0.
CVE-2026-42093 is a high-severity SQL injection vulnerability in the Redash data visualization package. It affects versions after 8.0.0 up to but not including 26.9.0. The flaw arises from improper handling of certain query parameters in the Query Results query runner, allowing authenticated users with view-only access to inject SQL commands and execute them with elevated privileges. This issue is fixed in version 26.9.0.
CVE-2026-109527 is a high-severity vulnerability in the Model Context Protocol Python SDK affecting versions before 1.29.1 and from 2.0.0a1 up to but not including 2.1.0. The issue involves the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffering entire HTTP request bodies without enforcing size limits. This allows an unauthenticated remote attacker to send large request bodies that exhaust server memory, potentially causing denial of service. Servers using stdio-only or with upstream request size limits are not affected. The vulnerability is fixed in versions 1.29.1 and 2.1.0.
CVE-2026-86849 is a medium severity vulnerability in Red Hat Fast Datapath for RHEL 10 involving an out-of-bounds write in the DPDK lib/vhost vhost-crypto component. The flaw arises from an integer overflow in chain length checks and missing length checks on the RSA path, which can cause a host buffer overflow in the vhost-crypto backend. This vulnerability affects availability but does not impact confidentiality or integrity. No specific affected versions or patch information is provided in the available data.
CVE-2026-86856 is a vulnerability in the DPDK nfp vDPA driver used in Red Hat Fast Datapath for RHEL 10. It involves an out-of-bounds write where stack and heap buffers sized for a single queue pair can be overflowed if more virtqueues are configured. This can lead to a host crash or memory corruption. The vulnerability has a CVSS score of 6.5, indicating medium severity. No affected versions or patch information are explicitly provided in the available data.
CVE-2026-86847 is a vulnerability in Red Hat Fast Datapath for RHEL 10 affecting the DPDK lib/vhost vhost-crypto component. The flaw involves the write-back chain cleanup process following an uninitialized next pointer when mapping a guest descriptor fails, which can cause the host vhost-crypto process to hang or crash. This results in a denial of service condition without impacting confidentiality or integrity.