CVE-2026-25814 is a critical injection vulnerability in PlaciPy version 1.0.0, a placement management system for educational institutions. The flaw arises because user-controlled query parameters are directly passed into DynamoDB query/filter construction without proper validation or sanitization. This improper neutralization of special elements (CWE-74) can allow attackers to manipulate queries, potentially leading to unauthorized data access or data integrity issues. The vulnerability has a high CVSS 4.0 score of 9.3, indicating network exploitable, no authentication or user interaction required, and high impact on confidentiality and integrity. Although no known exploits are reported in the wild yet, the critical severity demands immediate attention. European educational institutions using PlaciPy 1.
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29.
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries can be used to get an Array containing the host's Function constructor, by using Array.prototype.at you can obtain the hosts Function constructor, which can be used to execute arbitrary code outside of the sandbox. This vulnerability is fixed in 0.8.29.
CVE-2026-24043 is a medium severity vulnerability in the jsPDF JavaScript library versions prior to 4.1.0. It allows an attacker to inject arbitrary XML into the XMP metadata of generated PDFs via unsanitized input to the addMetadata function. This injection can compromise the integrity of PDFs, especially if they are signed or processed later. The vulnerability requires no authentication or user interaction and can be exploited remotely. The issue has been fixed in jsPDF version 4.1.0. European organizations using vulnerable jsPDF versions in their web applications or services that generate PDFs should update promptly to prevent potential integrity issues.
Vulnerability in Altitude Authentication Service and Altitude Communication Server v8.5.3290.0 by Altitude, where manipulation of Host header in HTTP requests allows redirection to an arbitrary URL or modification of the base URL to trick the victim into sending login credentials to a malicious website. This behavior can be used to redirect clients to endpoints controlled by the attacker.
CVE-2026-24010 is a high-severity file upload vulnerability in horilla versions prior to 1.5.0, an open-source Human Resource Management System. Authenticated attackers can upload malicious HTML files disguised as profile pictures, enabling phishing attacks by presenting fake login pages to users. This allows credential theft and potential account takeover without requiring user interaction beyond visiting the malicious URL. The vulnerability stems from improper neutralization of special elements in output used by downstream components (CWE-74). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. The issue is patched in version 1.5.0.
CVE-2026-24002 is a critical vulnerability in grist-core spreadsheet software versions prior to 1.7.9. It arises from improper sandboxing of Python formulas executed via pyodide on Node.js, allowing malicious spreadsheet documents to execute arbitrary processes on the server. The vulnerability is due to CWE-74, improper neutralization of special elements in output used by downstream components, leading to injection attacks. Exploitation requires no authentication or user interaction beyond opening a malicious document with the vulnerable sandbox setting. The issue is mitigated in grist-core 1.7.9 and later by running pyodide under the Deno runtime, which provides stronger sandboxing.
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.
Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available.
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.
CVE-2025-47286 is a high-severity code injection vulnerability in Combodo iTop, a web-based IT service management tool. It affects versions prior to 2.7.13 and between 3.0.0-alpha and before 3.2.2. An authenticated administrator can exploit improper neutralization of special elements in configuration parameters to execute arbitrary code on the server. The vulnerability requires administrator privileges but no user interaction, and it allows full compromise of confidentiality, integrity, and availability of the affected system.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing.
This issue affects HumanSuite: before 53.21.0.
A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication.