Cacti versions from 1.2.27 up to but not including 1.2.31 contain an authenticated stored second-order SQL injection vulnerability in the automation tree rule item handler. A user with Automation realm privileges can inject arbitrary SQL fragments that are later executed when an administrator applies automation rules, leading to potential data exfiltration via the UI. This vulnerability has been fixed in version 1.2.31.
serialize-javascript versions from 7.0.1 before 7.1.3 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to break out of HTML script elements by injecting unescaped </script sequences in serialized function source text. Attackers who can control a function's source via a spoofed toString() method may inject live markup such as img onerror handlers, potentially leading to script execution in the context of the affected application.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \{(.+)\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
CVE-2026-93640 is a local privilege escalation vulnerability in the dnscache package of Zimbra Collaboration Suite versions up to 10.1.21. It allows the Unix zimbra account to execute commands with root privileges due to an insecure passwordless sudo policy and improper argument handling in the zmunbound wrapper. This flaw enables attackers to supply malicious configurations that disable security features and expose sensitive root-owned files, potentially disclosing password hashes and private keys. The vulnerability can also corrupt privileged configuration files, causing service disruptions.
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.
A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar. ZCS 10.1.16 and 10.1.21 are affected.
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected.
The node-i18next-http-backend package version 4.0.2 contains an incomplete fix in the interpolateUrl() function. This flaw allows attackers who can control the namespace (ns) value to redirect translation requests by supplying a namespace starting with a slash. By crafting a protocol-relative URL in loadPath or addPath templates, attackers can load malicious translations from attacker-controlled hosts, potentially enabling UI content injection and cross-site scripting (XSS). The vulnerability has a low CVSS score of 3.1, indicating limited impact and requiring user interaction.
XDG Desktop Portal versions prior to 1.22.1 contain a vulnerability where malicious sandboxed applications can misuse the FileTransfer.RetrieveFiles method to intercept drag-and-drop and copy-paste data intended for other applications. The vulnerability arises from predictable token generation using GLib's GRand based on the Mersenne Twister PRNG, allowing attackers to predict future tokens and gain unauthorized access to resources. This issue has been fixed in version 1.22.1.
XDG Desktop Portal versions prior to 1.22.1 contain a vulnerability in the FileChooser.SaveFiles method that allows malicious sandboxed applications to gain arbitrary file access to non-existing files on the host system, limited to files accessible by the user. This occurs because the filenames provided are not validated by the frontend or common backends, enabling bypass of intended file existence checks. The issue has been fixed in version 1.22.1.
CVE-2026-99085 is a Linux kernel vulnerability affecting the CPU hotplug process when tasks managed by the BPF scheduler remain on a CPU that is going offline. This can cause the CPU hotplug thread to hang, potentially stalling the CPU offline operation. The issue arises because tasks on the BPF scheduler are still counted on the CPU's runqueue, but the CPU no longer dispatches these tasks, leading to a deadlock scenario. The fix involves re-enqueuing tasks on the local dequeue and ensuring dispatch continues until the runqueue goes offline.
CVE-2026-99081 is a vulnerability in the Linux kernel's bnxt_en driver affecting Intel BCM57412 NetXtreme-E NICs. It involves incorrect DMA mapping length for padded small packets, causing the NIC's DMA engine to read beyond the mapped buffer boundary. This results in IOMMU DMA read faults and transmit queue timeouts. The issue arises because the DMA mapping length does not account for padding added to small packets, leading to a DMA read buffer overrun. The vulnerability was introduced after a commit that changed VLAN headroom handling, causing small packets to be positioned near page boundaries. The fix ensures the DMA mapping length matches the padded packet size by adjusting skb length before mapping.
CVE-2026-99065 is a race condition vulnerability in the Linux kernel's cgroup cpuset subsystem related to CPU hotplug handling. The issue arises because the cpuset hotplug operation became synchronous, removing previous race handling code, but a subsequent change caused a race to reappear between cpu_active_mask updates and cpuset effective_cpus updates. This race can lead to the top cpuset having no active CPU, resulting in a NULL pointer dereference. The vulnerability affects specific Linux kernel versions and has been fixed by reintroducing a NULL check in guarantee_active_cpus().
CVE-2026-99059 is a high-severity vulnerability in the Linux kernel's WireGuard implementation related to the Noise protocol handshake. It involves a race condition where two threads process the same response message concurrently, potentially causing inconsistent handshake state and session creation. The flaw arises from improper synchronization during cryptographic state updates in the handshake process. Although exploitation is considered highly unlikely in practice, the vulnerability could allow an attacker to interfere with session establishment, impacting confidentiality and integrity. The issue has been resolved by adding a check comparing ephemeral private keys to ensure state consistency.
A vulnerability in the Linux kernel's workqueue subsystem could cause a NULL pointer dereference when checking chained work. This occurs because the worker's current_pwq pointer may be NULL outside of work-item execution, leading to a fault before a warning is emitted. The issue has been fixed by adding a guard to ensure current_pwq is valid before the chained-work test.