DOMSanitizer versions prior to 1.0.15 have an input validation flaw in the isDangerousUrl() method. The sanitizer rejects 'javascript:' URLs but only partially rejects 'data:' URLs by checking for the literal substring 'onload'. Because data: payloads are often Base64-encoded, dangerous content can bypass this check and remain in href or xlink:href attributes. This incomplete sanitization could allow active markup to persist. The issue is fixed in version 1.0.15.
FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7.
CVE-2026-12342 is a critical vulnerability in SailPoint Technologies IdentityIQ affecting versions 8.3 through 8.5p2. It allows unauthenticated remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
CVE-2026-100902 is a high-severity vulnerability in Barco ClickShare CX-20 Gen2 up to version 02.26.00.0007. It involves improper validation of the syntactic correctness of input in the Wallpaper Upload component, specifically in the /wallpaper file. The vulnerability can be exploited remotely without user interaction and requires low attack complexity. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.
CVE-2026-67234 is an improper input validation vulnerability in rabbitmq-server versions 4.2.0 through 4.2.7 and 4.3.0 through 4.3.1. The issue arises from the use of term_to_binary/1 on certain atoms to clear cookies, resulting in non-ASCII cookie names that violate RFC 6265. This can cause browsers to fail to delete authentication-mechanism preference cookies, leading to stale preferences persisting across logout and login cycles. The vulnerability does not allow code execution or data exfiltration. It is fixed in versions 4.2.8 and 4.3.2.
CVE-2026-100187 is an input validation vulnerability in the Onion module of the AIL Framework. The module incorrectly validates .onion URLs by only checking for a fixed length and suffix, without proper hostname parsing. This flaw allows unauthenticated attackers who can publish content crawled by the framework to inject arbitrary non-onion URLs into the crawler's task queue. The vulnerability leads to loss of integrity in the crawler's target selection, potentially causing the crawler to access unintended network resources. No authentication or user interaction is required to exploit this issue.
CVE-2026-100177 is an authorization bypass vulnerability in the ail framework's crawler task creation API. It allows an authenticated user with permission to create crawler tasks to attach another organization's cookiejar by UUID without proper access checks. This can lead to unauthorized use of another organization's stored cookies and session data during web crawls, potentially exposing sensitive session tokens and authentication credentials.
phpMyFAQ versions prior to 4.2.0-alpha contain an authenticated SQL LIKE wildcard injection vulnerability in the chat user search feature. This flaw allows any logged-in user to bypass the intended display-name search filter and enumerate active users by exploiting unescaped SQL LIKE wildcards '%' and '_'. The issue is fixed in version 4.2.0-alpha.
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.
CVE-2026-62998 is a medium severity vulnerability in the REDAXO PHP-based content management system core. Prior to version 5.21.2, the function rex_list::getSortColumn() improperly accepts a sort request parameter without verifying if the requested column is registered as sortable. This allows an authenticated backend user to cause the system to order query results by unauthorized columns, potentially exposing sensitive information such as user passwords through error-based enumeration. The issue is fixed in REDAXO version 5.21.2.
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.