CVE-2026-115680 is an out-of-bounds read vulnerability (CWE-125) affecting Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0. The flaw involves DHCPv6 Option processing, which may lead to over-reads of memory and unintended data retransmission. The vulnerability has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
A vulnerability in JIZHICMS up to version 2.5.6 affects the Pay function in the Front-end Order Handler component. The flaw involves improper authorization due to manipulation of the 'orderno' argument, allowing remote attackers to exploit this issue. The vulnerability has a medium severity rating with a CVSS score of 4.3. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.
CVE-2026-107656 is a critical authentication bypass vulnerability affecting multiple versions of Fortinet FortiSandbox and FortiSandbox PaaS. The flaw allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests. The affected versions include FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, all versions of 4.2, and corresponding FortiSandbox PaaS versions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.
XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the Local API component, specifically in the /general/user-info endpoint. This flaw allows remote attackers to obtain sensitive information without authentication. The vendor has not responded to disclosure attempts and no patch or fix is currently available.
Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723
CVE-2026-116283 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19. The flaw exists in the Local API component, specifically in the /profiles file, and can be exploited remotely. Upgrading to version 5.2.0 mitigates this issue.
Harbor versions prior to 2.15.3, 2.14.5, and 2.13.6 contain a Server-Side Request Forgery (SSRF) vulnerability in the webhook delivery component. An authenticated attacker with ProjectAdmin permissions can configure webhooks to target internal private or link-local IP addresses. When triggered, Harbor's jobservice makes unauthenticated HTTP POST requests to these targets. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata.
A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.
This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
A security flaw exists in libimobiledevice up to version 1.4.0 in the afc_get_device_info_key function of src/afc.c. This vulnerability involves memory corruption triggered by manipulating the argument Value. Exploitation requires local access. Public exploit code has been released, but the vendor has not responded to the disclosure. The CVSS score is 5.3, indicating a medium severity.