PowerProtect Data Domain versions 7.7.1.0 through 8.7, including certain LTS2024, LTS2025, and LTS2026 releases, contain a Relative Path Traversal vulnerability in the certificate handling. This flaw allows a high privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.
Artalk versions prior to 2.10.1 have a server-side request forgery (SSRF) vulnerability that can be exploited without authentication. Remote attackers can submit anonymous comments to the /api/v2/comments endpoint with a crafted page_key pointing to internal URLs. The server fetches the URL to retrieve the page title with only scheme validation, allowing attackers to read internal page titles via the public comment list. This vulnerability has a medium severity with a CVSS score of 5.3.
A denial of service vulnerability exists in a2aproject a2a-go up to version 2.4.0 in the Cancel function of the Distributed Manager component. This vulnerability can be exploited remotely and leads to service disruption. Upgrading to version 2.5.0 resolves the issue.
An observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis before version 4.8 allows attackers to perform account footprinting. This vulnerability has a high severity with a CVSS score of 7.5 and impacts confidentiality but not integrity or availability.
CVE-2026-103288 is an authorization bypass vulnerability in the Ghost blogging platform's comment like feature. It allows authenticated members to delete comment likes or dislikes they are not authorized to remove. This issue affects Ghost versions from 5.9.0 up to but not including 6.44.1. The vulnerability is fixed in version 6.44.1.
fpdf2 versions from 2.5.0 up to but not including 2.8.8 contain a vulnerability where nested SVG <use> references cause exponential growth in memory and CPU usage during PDF image processing. This can lead to resource exhaustion and process failure with a MemoryError. The issue arises from deep-copying referenced SVG graphics trees, allowing a crafted small SVG to consume excessive resources without external dependencies or special configurations.
CVE-2026-12887 is a path traversal vulnerability in Octopus Server that allows a user with permission to upload a malicious NuGet package to deploy a script step executing outside the intended directory. This could lead to unauthorized script execution beyond the parent directory boundaries. The vulnerability affects multiple versions of Octopus Server prior to fixed releases in 2026.1.674, 2026.2.973, and 2026.3.5839. The CVSS 4.0 score is 5.1, indicating a medium severity risk.
Codefriar sf-mcp versions up to 1.3.2 contain an OS command injection vulnerability. This flaw arises because the escapeValue() function does not properly neutralize shell metacharacters such as backticks and $() substitutions. As a result, crafted Salesforce CLI tool flag values can lead to arbitrary shell command execution with the privileges of the MCP server user. The vulnerability has a high severity score of 8.5 and affects all versions from 0 up to and including 1.3.2. A patch is available, and since this is a cloud service, the vendor manages remediation server-side.
CVE-2026-15586 is a vulnerability in İdvlabs Software and Consulting Services Inc.'s Ontime product that allows brute force attacks due to improper restriction of excessive authentication attempts. The vulnerability affects versions up to and including 2026-10-27. The vendor was contacted but did not respond to the disclosure. The CVSS score is 5.3, indicating a medium severity level.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper access control vulnerability. This flaw allows an unauthenticated remote attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 6.5, indicating a medium severity level.
A denial of service vulnerability exists in svg-sanitizer versions from 0.5.3 up to but not including 1.1.0. The flaw occurs in the Sanitizer::sanitize() function, which repeatedly rescans the entire input while stripping PHP tags. This behavior allows unauthenticated attackers to craft SVG files containing many overlapping PHP tag openers and closers, causing excessive CPU usage and service disruption.
REDAXO versions prior to 5.21.0 have a reflected cross-site scripting (XSS) vulnerability in the backend packages API. The flaw arises because a function parameter is concatenated into an error message without proper HTML escaping. An attacker can exploit this by tricking an authenticated backend user into clicking a crafted link containing a valid CSRF token, leading to execution of malicious JavaScript that can perform same-origin actions or read DOM data.
REDAXO versions before 5.21.4 have a broken access control vulnerability that allows authenticated editors to modify slices in categories they are not authorized to access. By pairing a permitted article with a foreign slice ID, attackers can abuse content editing, deletion, and slice status or movement APIs to delete, toggle, move, or overwrite slices belonging to other editors.
REDAXO versions before 5.21.4 have a missing authorization vulnerability in the media pool bulk move feature. The vulnerability arises because the system only checks permissions on the target category and ignores the source category. Authenticated backend users with permission on one media category can move files from restricted categories into their permitted category and replace their contents silently across the site.
REDAXO versions from 5.18.0 up to but not including 5.21.4 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the rex_media_service component moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can exploit a race condition or exhaust memory limits to leave malicious script-laden SVG files accessible, leading to script execution in victims' backend sessions.
REDAXO versions before 5.21.4 have a stored cross-site scripting (XSS) vulnerability. This flaw allows content editors to inject malicious HTML by submitting crafted input values that are stored and later rendered without proper escaping in media-related widgets. Exploitation can lead to script execution in administrators' backend sessions, potentially hijacking their accounts.
REDAXO versions before 5.21.5 have a missing authorization vulnerability in the backup addon export feature. This flaw allows non-admin users with the backup[export] permission to export any database table, including sensitive tables such as rex_user and rex_user_session. Exploitation can lead to attackers obtaining plaintext session IDs and stay-logged-in keys to hijack admin accounts or password hashes for offline cracking.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious script via Code-typed property values. The vulnerability arises because attackers can embed HTML markup inside a valid JSON value, which is then rendered unescaped on the Special:Browse page, leading to JavaScript execution in the browsers of users viewing the page.