Threat database

CVE-2026-103508 is a relative path traversal vulnerability in Perforce P4 Search (Helix core) that affects versions up to 2026.4.2. An authenticated user with administrative privileges on the connected P4 Server can supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. The issue is resolved in version 2026.4.3.

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

This content discusses the capabilities and limitations of AI-driven penetration testing compared to human pentesters. It highlights that AI pentesting can discover vulnerabilities missed by humans, especially complex issues that do not fit strict testing methodologies. However, AI lacks the ability to ask clarifying questions or fully understand business context, which can affect risk assessment and scope management. The article emphasizes that neither AI nor human pentesters find all vulnerabilities consistently, and that AI excels in detailed source code analysis and remediation guidance. The content is an analysis of AI pentesting technology rather than a specific security vulnerability or threat.

CVE-2026-93649 is a high-severity vulnerability in the Eclipse Foundation Adoptium Temurin website. The issue arises from improper validation of a redirect URL on the post-download page, which uses a naive string prefix check vulnerable to bypass via dot-segment normalization. This allows an attacker to craft a URL that appears to redirect to a trusted domain but actually leads to an attacker-controlled location, causing users to unknowingly download malicious binaries.

CVE-2026-106148 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the TabStrip, Menu, and PanelBar components. These components improperly insert imageUrl values into single-quoted image src attributes without proper escaping, allowing attackers who can modify image URLs to inject HTML attributes and execute JavaScript in users' browsers. This vulnerability affects versions from 2011.2.804 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106147 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The issue exists in versions from 2020.1.114 up to but not including 2026.3.1015, where the ListBox default item template renders bound data as raw HTML without encoding. This allows an attacker who can control the bound data to inject HTML with event handlers that execute JavaScript in users' browsers. The vulnerability can lead to compromise of confidentiality and integrity of data accessible to the application. The issue is fixed in version 2026.3.1015.

CVE-2026-106161 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The Badge text method improperly renders string values as raw HTML without encoding, allowing injection of malicious scripts via data bound to a Badge. This vulnerability affects versions from 2020.1.114 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106160 is a prototype pollution vulnerability in Progress Software Kendo UI for jQuery versions from 2023.1.117 up to but not including 2026.3.1015. The issue arises because the Model.accept function passes server-response keys to kendo.setter without properly filtering unsafe object paths such as __proto__, constructor, or prototype. This allows an attacker who can supply crafted data to modify object prototype attributes, potentially affecting application behavior and compromising confidentiality and integrity of data. The vulnerability is fixed in version 2026.3.1015.

CVE-2026-106159 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. It affects versions from 2022.3.1109 up to but not including 2026.3.1015. The issue arises because ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization, allowing an attacker to inject JavaScript via specially crafted URLs. This can lead to execution of malicious scripts in the user's browser when interacting with the affected buttons. The vulnerability is fixed in version 2026.3.1015.

CVE-2026-106158 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2014.3.1119 up to but not including 2026.3.1015. The issue occurs because resource color values are inserted into event wrapper attributes without proper encoding, allowing attackers who control these colors to inject malicious HTML attributes and JavaScript. This can lead to compromise of data confidentiality and integrity when users interact with affected events. The vulnerability has a medium severity with a CVSS score of 4.7 and is fixed in version 2026.3.1015.

A cross-site scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery's PanelBar component. Versions from 2019.2.514 up to but not including 2026.3.1015 improperly insert URL values into a single-quoted href attribute without proper encoding. This allows an attacker controlling the URL to inject HTML attributes and JavaScript, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106162 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery's FileManager component. Versions from 2023.3.1010 up to but not including 2026.3.1015 improperly render remotely supplied item names as HTML in drag hints, allowing injection of malicious scripts. This can lead to execution of JavaScript in a user's browser during drag operations, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106163 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the FileBrowser and ImageBrowser components. Versions from 2023.1.117 up to but not including 2026.3.1015 improperly render attacker-controlled file and directory names as HTML without proper encoding. This allows execution of arbitrary JavaScript in the user's browser, potentially compromising confidentiality and integrity of accessible data. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No official patch or remediation details are provided in the input data.

Microsoft announced that Windows Server 2022 reached the end of mainstream support as of October 13, 2026. The product will continue to receive extended support, including security updates, until October 14, 2031. Hotpatching support for the Datacenter: Azure Edition will continue until October 2027. Microsoft recommends upgrading to Windows Server 2025, which offers full mainstream support and will be supported until November 2034. This announcement also includes related end-of-support notices for Windows 11 versions.

CVE-2026-109686 is a critical vulnerability in Link Whisper INC's Link Whisper Free plugin, affecting versions from initial release up to 0.9.7. It involves deserialization of untrusted data, leading to object injection. This flaw can allow an attacker to execute arbitrary code or cause denial of service without any user interaction or privileges.

CVE-2026-109685 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in Link Whisper INC's Link Whisper Free plugin. It affects versions from initial releases up to 0.9.7. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is currently provided.

CVE-2026-109892 is a critical vulnerability in Frontend Admin by DynamiApps (Shabti Kaplan) that allows incorrect privilege assignment leading to privilege escalation. It affects versions from 0 up to and including 3.29.13. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-102389 is a code injection vulnerability in the WPMU DEV Broken Link Checker plugin affecting versions from the initial release up to 2.4.14.1. This vulnerability allows an attacker to inject code due to improper control over code generation. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. It requires no privileges but user interaction is needed. There is no information about an official patch or fix available at this time.

CVE-2026-105882 is a stored cross-site scripting (XSS) vulnerability in the ThemeGrill User Registration plugin affecting versions from initial release up to 5.2.8. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This can lead to partial compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No official patch or vendor advisory is provided in the input data. Users should check the vendor's resources for remediation updates.