NI vulnerabilities and threats

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts.

CVE-2026-108185 is a high-severity vulnerability in Zoom Clients involving improper certificate validation in the My Notes feature. This flaw may allow an unauthenticated attacker with network access to disclose sensitive information. The vulnerability does not require user interaction or privileges but has a high attack complexity. No patch or remediation details are provided in the available data.

CVE-2026-102342 is a stored cross-site scripting (XSS) vulnerability in the rust-ammonia library, which is used to sanitize untrusted HTML. Versions prior to 3.3.3, 4.0.3, and 4.1.4 allow SVG animate or set elements with an attributeName targeting href and a javascript scheme value to persist. This enables attackers to embed script-bearing links that execute attacker-controlled scripts in the application's origin when clicked. The issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

CVE-2026-108184 is a high-severity vulnerability in certain Zoom Clients for Windows involving improper certificate validation. This flaw may allow an unauthenticated attacker with network access to disclose sensitive information. The vulnerability does not require user interaction and has a high impact on confidentiality. No affected versions or patch information are provided in the available data.

CVE-2026-53420 is a buffer overflow vulnerability in the Zoom Phone feature of Zoom Workplace Clients. It may allow an unauthenticated attacker to escalate privileges via network access. The vulnerability affects versions prior to 7.2.0. The CVSS score is 8.0, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-53418 is a high-severity vulnerability in Zoom Workplace for Android before version 7.2.1. It involves improper authorization in the handler for a custom URL scheme, which may allow an unauthenticated user to escalate privileges via network access. The vulnerability has a CVSS score of 8.1, indicating a significant impact on confidentiality and integrity without requiring user interaction. No known exploits are reported in the wild. The issue is fixed in version 7.2.1.

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

CVE-2026-109156 is a path traversal vulnerability in SeldonIO MLServer affecting versions 1.6.0 and 1.6.1. The flaw exists in the _extract_env function within the mlserver/env.py file, specifically in the environment_tarball Handler component. This vulnerability allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The vendor has not provided a response or patch at the time of disclosure. The CVSS 4.0 score rates this issue as medium severity.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This issue affects Books Gallery: from n/a through 4.8.4.

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.

CVE-2026-75826 is a high-severity OS command injection vulnerability in Teltonika Networks RUTOS and TSWOS devices. It affects the backup function in multiple device models running RUTOS versions 7.22 before 7.24.6 and 7.25 before 7.25.2, as well as TSWOS versions 1.9 before 1.10.4. The flaw allows a remote authenticated attacker to execute arbitrary operating system commands.

Parse Server versions before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 have an authorization bypass vulnerability in count queries using the $relatedTo operator. This flaw allows authenticated users who can read an owning object to infer confidential membership information such as private groups or block lists by exploiting the lack of enforcement of identity-scoped protectedFields on these queries.

Parse Server versions 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 have an authorization flaw in their GraphQL introspection control. The control is applied only to operation text sent directly with a request, but not to operations resolved from Apollo Server's automatic persisted query cache. This allows unauthenticated attackers with the public Application Id and client key to replay cached introspection queries originally made by privileged clients, thereby retrieving the schema including private class and field names.

Parse Server versions before 8.6.95 and versions from 9.0.0 up to but excluding 9.10.2-alpha.3 contain a vulnerability where file references lacking a URL are not resolved before being passed to Cloud Code triggers and LiveQuery. This causes an uncaught exception that terminates the server process. Attackers with the ability to write to classes with Cloud Code save, find, or delete triggers or LiveQuery enabled can exploit this to crash the server or disrupt subsequent requests. This includes unauthenticated users if public write access or sign-up is allowed.

CVE-2026-12613 is a high-severity vulnerability in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor affecting Windows, Linux, and MacOS versions prior to 5.4.20 and 5.4.21. It involves deserialization of untrusted data, which allows object injection. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No explicit patch or remediation details are provided in the available data.

CVE-2026-18390 is an OS command injection vulnerability in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows, Linux, and iOS platforms. It affects versions before 5.4.20 and 5.4.21. The vulnerability arises from improper neutralization of special elements used in OS commands, allowing potential command injection. The CVSS 3.1 score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, so patch status is not confirmed.

CVE-2026-108801 is a medium severity vulnerability in prasathmani TinyFileManager up to version 2.6. It involves an unrestricted file upload flaw in the move_uploaded_file function within tinyfilemanager.php. This vulnerability allows remote attackers to upload files without proper restrictions. The exploit code has been publicly released. The vendor was contacted but did not respond or provide a fix.

CVE-2026-108787 is a server-side request forgery (SSRF) vulnerability in houtini-ai voice-analyser-mcp versions 2.1.0 and 2.1.1. The flaw exists in the fetch function of src/utils/crawler.ts within the collect_corpus component, where manipulation of the sitemap_url argument allows SSRF. Remote exploitation is possible, and a public exploit is available. The vendor has not responded to disclosure attempts. The CVSS 4.0 score is 5.3, indicating medium severity.

CVE-2026-108786 is a server-side request forgery (SSRF) vulnerability in the houtini-ai seo-crawler-mcp product, specifically in the run_seo_audit function of src/core/CrawlOrchestrator.ts. It affects versions 2.1.0 through 2.1.5. The vulnerability allows remote attackers to manipulate server requests, potentially causing unauthorized requests to internal or external systems. The vendor has not responded to the disclosure, and no patch or fix is currently available. The CVSS 4.0 score rates this as a medium severity issue.

CVE-2026-66086 is a high-severity stack-based buffer overflow vulnerability in the modem OTA stack of Unisoc (Shanghai) Technologies Co., Ltd. modems. It arises from improper validation of scheduling information in SIB1 messages. Exploitation could allow remote code execution or denial of service without requiring additional privileges.