There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
CVE-2026-116463 is an out-of-bounds read vulnerability in FastStone Image Viewer versions 8.0 through 8.5. The flaw exists in the Box-Average Downsampler Engine component, specifically in the function FUN_0062d96c. This vulnerability can be triggered remotely and may lead to information disclosure or application instability. The vendor has not responded to the disclosure, and no patch or mitigation guidance is currently available.
CVE-2026-116384 is an improper authorization vulnerability in Bdtask Garage 24 Garage Management Software version 1.0. The flaw exists in the backend component and can be exploited remotely without user interaction. Public exploit code is available, but the vendor has not responded or issued a fix. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVE-2026-115680 is an out-of-bounds read vulnerability (CWE-125) affecting Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0. The flaw involves DHCPv6 Option processing, which may lead to over-reads of memory and unintended data retransmission. The vulnerability has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
A security vulnerability in Kameleo up to version 5.3.1 affects the Local API component, specifically the /general/user-info endpoint. This vulnerability allows remote attackers to cause information disclosure. The vendor was notified but has not responded. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A weakness in Kameleo up to version 5.0.1.26 affects the Local API component, specifically the /profiles file, allowing remote attackers to cause information disclosure. The issue is mitigated by upgrading to version 5.2.0.
A security flaw in Kameleo up to version 5.3.1 affects the CookieController.ListCookies function, allowing remote attackers to manipulate the 'guid' argument to disclose information. The vulnerability is classified as CWE-200 (information disclosure). The vendor was contacted but did not respond, and no patch or fix information is available. The CVSS 3.1 base score is 4.3, indicating a medium severity issue.
A vulnerability in JIZHICMS up to version 2.5.6 affects the Pay function in the Front-end Order Handler component. The flaw involves improper authorization due to manipulation of the 'orderno' argument, allowing remote attackers to exploit this issue. The vulnerability has a medium severity rating with a CVSS score of 4.3. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.
CVE-2026-107656 is a critical authentication bypass vulnerability affecting multiple versions of Fortinet FortiSandbox and FortiSandbox PaaS. The flaw allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests. The affected versions include FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, all versions of 4.2, and corresponding FortiSandbox PaaS versions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.
XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768