CVE-2026-113790 is a vulnerability in the pypdf library prior to version 6.21.0 where an attacker can craft a PDF with large arrays or dictionaries, causing excessive memory consumption during parsing. This uncontrolled resource consumption can lead to denial of service conditions. The issue is fixed in version 6.21.0.
CVE-2026-114490 is an incorrect authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.6. It affects the COM administration API, allowing accounts assigned the serveradmin role with a restricted domain list to gain full server administrator privileges over all domains. This bypasses intended role restrictions, enabling unauthorized access to all domain accounts, mail, server settings, and the ability to create additional server-administrator accounts. Accounts with serveradmin role but no domain list and other roles like help desk or auditor are not affected.
CVE-2026-114489 is a high-severity vulnerability in Progressive Robot Ltd hMailServer versions 6.0.0 through 6.3.6. It involves missing authorization checks in the REST and COM administration APIs, allowing remote authenticated users with domain-confined credentials to perform unauthorized changes beyond their allowed domains on multi-tenant servers. Attackers can manipulate mail routing, domain configurations, domain aliases, domain renaming, and rule actions, potentially diverting or denying mail for other tenants. The vulnerability arises because authorization gates do not properly restrict these actions to the caller's permitted scope.
CVE-2026-113789 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. It allows an attacker to craft a malicious PDF that triggers uncontrolled resource consumption, leading to excessive memory usage or prolonged processing times when the application extracts form fields from the document. This issue has been addressed and fixed in version 6.21.0.
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.
CVE-2026-114255 is a medium severity SQL injection vulnerability in the oretnom23 file-management-system-php. It affects the save_user function in the admin_class.php file within the User Account Management component. The vulnerability arises from improper handling of the name, username, password, type, and id arguments, allowing remote attackers to perform SQL injection. The product uses a rolling release model, so specific affected or fixed versions are not available. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a patch.
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.
Progressive Robot Ltd hMailServer versions 6.0.0 through 6.3.6 have a vulnerability where the original sender is insufficiently preserved during mail forwarding. This allows a remote unauthenticated attacker to send mail that appears to pass the domain's DMARC policy by exploiting forwarding mechanisms combined with certain server settings. Exploitation requires specific forwarding configurations and enabling of Sender Rewriting Scheme or envelope sender rewriting. The vulnerability can cause mail to be delivered as if it originated from the hosted domain, potentially bypassing SPF and DMARC checks.
CVE-2026-114477 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.2.25 through 6.3.6. It allows a remote authenticated user with credentials confined to specific named domains to access server-wide traffic history metrics that should be restricted. The exposed data consists of aggregate operational counters over the last 30 days, not individual messages or account details. The flaw arises because the metrics route does not enforce domain confinement checks, unlike other report routes. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-114476 is an incorrect authorization vulnerability in the REST administration API of Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.6. It allows a remote authenticated user with manage_roles permission in certain domains or assigned the serveradmin role with domain lists to escalate privileges to full server administrator authority by exploiting a flaw in role removal logic. Specifically, the API route for deleting role assignments does not properly verify authorization after role removal, enabling privilege escalation and unauthorized access.
CVE-2026-114475 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.6. It allows a remote authenticated user with credentials confined to specific named domains to improperly modify custom roles assigned to accounts in other domains. This includes creating, updating, and deleting custom roles beyond their authorized scope. However, the vulnerability does not allow elevation to server administrator privileges via custom roles.
CVE-2026-114474 is a medium severity vulnerability in Progressive Robot Ltd hMailServer versions 6.0.0 through 6.3.6. It involves the use of a less trusted source for the envelope sender address when downloading mail from external POP3 or IMAP accounts. This flaw allows a remote unauthenticated attacker to send mail that appears to originate from a domain hosted by the server, passing SPF and DMARC checks at receiving mail servers. The vulnerability arises because the server uses the From header address as the envelope sender without proper validation, enabling spoofing of the envelope sender domain. No non-default settings or DMARC policies are required for exploitation. The attacker must know a mailbox that the server collects mail for and forwards externally. No known exploits are reported in the wild, and no official patch information is provided.
CVE-2026-114473 is an incorrect authorization vulnerability in the Sender Rewriting Scheme (SRS) implementation of Progressive Robot Ltd's hMailServer versions 6.2.1 through 6.3.6. The flaw allows remote attackers holding a valid SRS address to relay mail through the server to external addresses without proper SMTP authentication. This occurs because the server treats all messages to valid SRS addresses as local deliveries, bypassing relay restrictions. SRS is disabled by default in hMailServer.
CVE-2026-114472 is a low-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It involves an insufficient resource pool in the ACME HTTP-01 challenge responder, which handles TLS certificate issuance and renewal. The responder accepts only one connection at a time and waits up to five seconds for a request, allowing unauthenticated remote attackers to hold the connection idle and cause certificate validation failures. This can lead to certificate expiration and subsequent TLS refusal by clients, although the mail service continues to operate with the existing certificate until expiration. Version 6.3.7 improves this by allowing up to 64 simultaneous connections, mitigating the issue by requiring an attacker to maintain many idle connections concurrently to cause disruption.
CVE-2026-114471 is a vulnerability in Progressive Robot Ltd's hMailServer SMTP server versions 6.0.0 through 6.3.6. It involves insertion of sensitive authentication information into log files when SMTP logging is enabled. Certain authentication credentials, including PLAIN passwords sent in non-standard ways, OAuth 2.0 bearer tokens, SCRAM-SHA-256 client proofs, and GSSAPI authenticators, may be logged in cleartext or partially exposed. SMTP logging is off by default, but on Windows systems before version 6.3.6, the log folder permissions allowed any local user to read the logs, increasing risk of credential exposure.
CVE-2026-114470 is a Cross-Site Request Forgery (CSRF) vulnerability in the REST API of Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It allows a remote attacker to cause an authenticated user's browser to perform state-changing actions without their consent. The vulnerability arises because the REST API uses HTTP Basic authentication, which browsers cache and send automatically with requests, including cross-origin form submissions. The server does not enforce CSRF protections on HTTP Basic authentication, enabling blind forgery of actions such as creating domains, accounts, or API keys by an attacker controlling a malicious webpage visited by an authenticated user. The attacker cannot read the responses to these forged requests.
Two critical unauthenticated remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP core versions since 5.4. These flaws, collectively dubbed “php2shell,” can be triggered by a plain HTTP request before any application code runs. The vulnerabilities arise from improper handling of out-of-memory conditions and use-after-free stale internal states. The impact spans the entire PHP ecosystem, including popular applications like WordPress, Drupal, Magento, and others. PHP 8.1 and older versions are end-of-life and will not receive patches, while PHP 8.2 support ends December 31, 2026. No active exploitation has been observed as of October 21, 2026. Cisco Talos recommends immediate upgrading to fixed releases and provides intrusion prevention signatures for detection. Some configuration mitigations may reduce exposure but do not fully protect against these vulnerabilities.
CVE-2026-114462 is a medium severity vulnerability in Velneo vServer involving improper link resolution before file access, also known as 'link following'. It affects versions from 36.0 up to but not including 36.6, and from 37.0 up to but not including 37.2. The vulnerability could allow an attacker with low privileges and partial attack complexity to influence file access behavior. No known exploits are reported in the wild, and no official patch information is provided in the data.