EspoCRM versions prior to 9.3.4 contain a relative path traversal vulnerability in the admin template management endpoints. Authenticated admin users can manipulate 'name' and 'scope' parameters to traverse directories and read, create, overwrite, or delete arbitrary files named body.tpl or subject.tpl within the web application user's filesystem permissions. This issue is fixed in version 9.3.4.
EspoCRM versions prior to 9.3.4 contain a critical path traversal vulnerability in the built-in formula scripting engine. This flaw allows an authenticated administrator to overwrite the sourceId field of Attachment entities, which is used unsafely in file path construction without sanitization. Exploitation enables redirecting file read or write operations to arbitrary paths within the web server's open_basedir scope. The issue is fixed in version 9.3.4.
CVE-2026-3837 is a cross-site scripting (XSS) vulnerability in Frappe version 16.10.0. An authenticated attacker can inject crafted values into multiple field types, which are then stored and later rendered without proper escaping in the Desk interface. This allows client-side script execution when another user views the affected document. The vulnerability arises from vulnerable formatter implementations that interpolate stored values directly into raw HTML attributes and element content.
CVE-2026-3673 is a cross-site scripting (XSS) vulnerability in Frappe version 16.10.10. An authenticated attacker can inject crafted tag values into the _user_tags field, which are then rendered without proper escaping in list or report views. This allows JavaScript execution when a victim views these tags.
DDEV versions prior to 1.25.2 contain a path traversal vulnerability in the Untar() and Unzip() functions of pkg/archive/archive.go. This flaw allows extraction of archive contents without proper path validation, potentially enabling attackers to overwrite arbitrary files during archive extraction. The issue is fixed in version 1.25.2.
CVE-2026-3254 is a low-severity vulnerability in GitLab CE/EE version 18.11 that allows an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox. This issue was fixed in GitLab version 18.11.1.
CVE-2026-4922 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in GitLab CE/EE. It affects all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1. The flaw could allow an unauthenticated attacker to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protections.
CVE-2026-1660 is a vulnerability in GitLab CE/EE versions 12.3, 18.10, and 18.11 that could allow an authenticated user to cause a denial of service when importing issues due to improper input validation leading to resource allocation without limits or throttling. The issue has been remediated in later versions.
A cross-site scripting (XSS) vulnerability in GitLab CE/EE versions 16.1.0 through before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 could allow an unauthenticated user to access tokens in the Storybook development environment due to improper input validation. This issue has been remediated in fixed versions.
CVE-2026-5377 is an authorization vulnerability in GitLab CE/EE version 18.11 that allowed authenticated users to view titles of confidential or private issues in public projects. The flaw was due to improper access control in the issue description rendering process. This issue was fixed in version 18.11.1.
CVE-2026-5816 is a high-severity vulnerability in GitLab CE/EE versions 18.10 and 18.11 prior to 18.10.4 and 18.11.1. It involves improper resolution of path equivalence that could allow an unauthenticated user to execute arbitrary JavaScript in another user's browser session under certain conditions. This cross-site scripting (XSS) flaw is due to insufficient path validation.
CVE-2026-6515 is a medium severity vulnerability in GitLab CE/EE affecting versions 18.2 through before 18.9.6, 18.10 through before 18.10.4, and 18.11 through before 18.11.1. It involves insufficient session expiration that could allow a user to access Virtual Registries using invalidated or incorrectly scoped credentials under certain conditions. The issue has been fixed in versions 18.9.6, 18.10.4, and 18.11.1.
A vulnerability in the Linux kernel's cxl/region component was fixed to address a resource leakage issue in the __construct_region() function. The fix ensures that if the first sysfs_update_group() call fails, the allocated resource is explicitly freed, preventing a memory leak.
A vulnerability in the Linux kernel's xfrm iptfs module could cause a kernel panic due to improper handling of non-linear socket buffers (skb) during packet reassembly. The issue occurs when skb_put() is called on a non-linear skb, triggering a kernel oops. The flaw has been fixed by adding a check to linearize the skb before appending data.
A circular locking dependency vulnerability was identified and fixed in the Linux kernel's NFC subsystem, specifically in the nci_close_device function. The issue involved flushing workqueues while holding a mutex lock, which could cause deadlocks. The fix moves the flushing operation after releasing the lock to prevent this condition. This bug was observed during self-testing but no exploitation in the wild is known.
CVE-2026-31501 is a critical use-after-free vulnerability in the Linux kernel's ti icssg-prueth network driver. The flaw occurs because a CPPI descriptor is freed before all pointers referencing it are fully accessed during packet reception, specifically in the RX path involving timestamp processing. This can lead to memory corruption on every received packet that triggers the timestamp path.
A use-after-free vulnerability in the Linux kernel's drm/xe/pf component was fixed. The flaw occurs when an error from xe_sriov_pf_migration_restore_produce() does not clear a data pointer, leading to potential use-after-free in subsequent write operations. This issue has been addressed by setting the pointer to NULL upon error.
CVE-2026-31489 is a vulnerability in the Linux kernel's meson-spicc SPI controller driver where a double release (double-put) of a controller reference occurs during device removal. This happens because the controller reference is already dropped by devm cleanup after registration, and an additional spi_controller_put() call in the remove path causes the double-put.
CVE-2026-31484 is a high-severity vulnerability in the Linux kernel's io_uring subsystem. It involves an out-of-bounds (OOB) read in the SQE_MIXED wrap check within the __io_uring_show_fdinfo() function. The flaw arises because the wrap check incorrectly uses an incremented sq_head counter rather than directly checking the actual array index, potentially allowing reading beyond the intended buffer boundary.
A vulnerability in the Linux kernel tracing subsystem can cause a NULL pointer dereference and kernel crash if kernel thread (kthread) creation fails during boot-time trigger registration. This occurs because deferred trigger frees are not properly drained, leading to memory leaks and eventual crash when the deferred list is accessed.