CVE-2026-107590 is an out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding within the Qt 5 Compatibility APIs module. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer, potentially causing application crashes and affecting data integrity. The vulnerability affects Qt versions from 4.5.0 up to and including 6.8.8, and from 6.9.0 up to and including 6.11.2. The CVSS 4.0 base score is 1.9, indicating low severity. No public exploits or patches are currently documented.
CVE-2026-100164 is an observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd.'s Agentis product. This flaw allows attackers to perform account footprinting by observing differences in system responses. The vulnerability affects Agentis versions prior to 4.8. A fix is available in version 4.8. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.
CVE-2026-13162 is an OS command injection vulnerability in Hitachi Energy's CoreTec 5 product. It affects the configuration daemon's time synchronization handler, which sets the system time-zone. Authenticated users with certain roles can exploit this flaw by supplying crafted input that is concatenated into shell commands without sanitization, allowing arbitrary system command execution with full device control. The vulnerability affects versions from 3.0.0 through 5.0.0 inclusive. The CVSS 4.0 score is 7.7, indicating high severity.
REDAXO core versions before 5.21.0 have a reflected cross-site scripting (XSS) vulnerability in the backend packages API. The flaw arises because a function parameter is concatenated into an error message without proper HTML escaping. An attacker can exploit this by tricking an authenticated backend user into clicking a crafted link containing a valid CSRF token, leading to JavaScript execution that can perform same-origin actions or read DOM data. This vulnerability is fixed in version 5.21.0.
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
REDAXO core versions before 5.21.4 have a missing authorization vulnerability in the structure/version and structure/history frontend preview modes. These modes do not verify category or clang permissions for the previewed article, allowing any backend user or users with the history[article_rollback] permission to access unpublished, historic, or deleted content by manipulating parameters.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via Code-typed property values. The vulnerability arises because the CodeStringValueFormatter renders annotated JSON values with embedded HTML markup unescaped on the Special:Browse page, enabling execution of JavaScript in the browsers of users viewing the page. The issue is fixed in version 7.3.1.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.
SemanticMediaWiki versions from 5.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability in the ext.smw.tooltip.tippy.js component. This flaw allows editors to inject malicious JavaScript via specially crafted data-* attributes in .smw-highlighter spans, which execute when users hover over them. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a vulnerability that allows low-privilege editors to cause uncontrolled resource consumption. By supplying a large limit parameter to the #set_recurring_event parser function without specifying an end date, attackers can generate a massive number of date subobjects. This leads to exhaustion of CPU, memory, and database resources. The issue is fixed in version 7.3.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 have an authorization vulnerability that allows ordinary editors to permanently protect pages by adding an 'Is edit protected' annotation. This occurs when the $smwgEditProtectionRight setting is enabled, causing the EditProtectionUpdater to apply indefinite edit and move restrictions without verifying the author's permissions, effectively locking out other editors and administrators.
CVE-2026-82121 is an origin validation error vulnerability in Hitachi HiRDB Server Version 10 and certain versions of Version 9. It allows an attacker to bypass origin checks, potentially leading to unauthorized data access. The vulnerability affects multiple versions prior to 10-12-01 and specific 9.x versions. It has a high severity with a CVSS score of 7.5. A fix is available in version 10-12-01.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the category management functionality of the Phoca Download extension for Joomla versions 3.1.0 through 6.1.5. This vulnerability allows an attacker to trick an authenticated user into performing unwanted actions without their consent.
The Kirki WordPress plugin up to version 6.2.5 contains a privilege escalation vulnerability via PHP Object Injection. This occurs due to deserialization of untrusted input in an AJAX dispatcher without proper capability checks, allowing authenticated users with Subscriber-level access or higher to inject PHP objects. Exploitation can lead to overwriting an administrator's password and gaining full administrative control.
A vulnerability in virtualenv's venv creator allows attacker-controlled pathnames containing Unicode line boundary characters (e.g., U+2028) to inject additional configuration keys into the pyvenv.cfg file during readback. This can alter the 'home' path and 'include-system-site-packages' setting, potentially changing the interpreter's standard library location and weakening environment isolation. The issue affects virtualenv versions from 20.0.0b1 up to but not including 2.5.1_1. A fix is available in version 2.5.1_1.
CVE-2026-18449 is a vulnerability in SMCI X12SPI version 01.07.20 where the Baseboard Management Controller (BMC) fails to properly enforce integrity and encryption for IPMI commands. This flaw allows an attacker to craft malicious packets that can execute arbitrary commands on an active session without requiring privileges or user interaction. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-107472 is an out-of-bounds read vulnerability in the QTextCodec TSCII encoding component of the Qt 5 Compatibility APIs module. This flaw affects Qt versions from 4.0.0 up to 6.8.8 and from 6.9.0 up to 6.11.2. Applications converting text to TSCII encoding via QTextCodec may read memory beyond the input buffer, potentially causing crashes or incorrect data interpretation. The vulnerability has a medium severity score of 4.3 and does not have known exploits in the wild.