Search: 13.3-13

Highcharts JS versions from 1.0.0 up to but not including 4.2.3 contain a cross-site scripting (XSS) vulnerability in the Highcharts Dashboards feature. The issue arises because the dashboard uses an unchecked property lookup to invoke chart constructors, allowing an attacker controlling dashboard configuration to execute arbitrary markup and event handlers in the hosting page without user interaction. This vulnerability is fixed in versions 4.2.3 and 13.1.0.

Highcharts JS versions from 12.0.0 up to but not including 12.6.1, and from 13.0.0 up to but not including 13.1.0, are affected by a cross-site scripting (XSS) vulnerability. This occurs because Highcharts falls back to assigning raw markup to innerHTML when DOMParser fails, before applying its allow-list. In Chromium browsers, this can lead to execution of untrusted HTML event handlers during the beforeprint event when charts are redrawn. The vulnerability affects HTML-rendered titles, labels, data labels, responsive text, and related Highcharts products. The issue is fixed in versions 12.6.1 and 13.1.0.

Highcharts JS versions from 10.3.2 up to but not including 11.4.9, 12.0.0 up to 12.6.2, and 13.0.0 up to 13.1.1 contain a cross-site scripting (XSS) vulnerability. This occurs because the SVG anchor xlink:href attribute does not enforce the allowed-scheme check that is applied to href and src attributes. An attacker controlling chart text options can embed a javascript URL that executes script when the exported or server-rendered SVG is parsed and the link is activated. The issue is fixed in versions 11.4.9, 12.6.2, and 13.1.1.

The Drupal Commerce module has a vulnerability where it does not properly restrict product variations returned by entity queries to those viewable by the current user. When the core JSON:API module is enabled, an attacker can make repeated requests to infer certain field values of unpublished product variations or variations of unpublished products. This issue affects versions prior to 2.41.0 and versions from 3.0.0 up to but not including 3.3.13. A fix is available in versions 2.41.0 and 3.3.13.

A vulnerability in the Drupal Commerce module allows users with permissions to create or edit their own stores to improperly mark their store as the site's default store. This improper access control can cause the affected store to receive orders it should not normally get. The issue affects sites that grant such permissions to untrusted users, such as marketplaces where vendors manage their own stores. Fixed versions are 2.41.0 and 3.3.13.

A vulnerability in the Drupal Commerce module allows users with permission to manage their own promotions to delete or modify coupons belonging to other promotions due to insufficient access checks on the relationship between promotions and coupons. This issue requires that the site accepts writes via JSON:API or REST, which is not enabled by default, mitigating the risk. Fixed versions 2.41.0 and 3.3.13 address this vulnerability.

A vulnerability in the Drupal Commerce module allows insufficient protection of certain routes and entity fields, leading to an access bypass. This flaw can financially impact the vendor by enabling unauthorized access to commerce functions. The issue affects versions prior to 2.41.0 and versions from 3.0.0 up to but not including 3.3.13. A fix is available in versions 2.41.0 and 3.3.13. The vulnerability is actively exploited in the wild.

CVE-2026-103506 is a high-severity vulnerability in Grafana OSS and Enterprise versions 13.2.0 through 13.2.4 when the experimental kubernetesSsoSettingsApi feature toggle is enabled. It allows an authenticated user with limited privileges to read SSO client secrets and modify instance-wide SSO settings without proper authorization. This feature toggle is disabled by default.

CVE-2026-88858 is a vulnerability in Grafana OSS where a user with Viewer role can crash the server by submitting a crafted server-side math expression that causes uncontrolled recursion. Additionally, a user with permission to provision alert rules can make the outage persist across server restarts. The vulnerability affects multiple versions of Grafana OSS from 7.4.0 through 13.2.4 in various subranges.

CVE-2026-88967 is a server-side request forgery (SSRF) vulnerability in Grafana Enterprise affecting users with query access to an Azure Monitor data source. Exploiting this flaw allows an attacker to cause the server to make requests to attacker-controlled endpoints, potentially disclosing the Azure access token associated with the data source. This vulnerability affects multiple versions of Grafana Enterprise from 10.0.0 through 13.2.4. A patch is available to address this issue.

CVE-2026-100105 is an incorrect authorization vulnerability in Grafana Enterprise that allows a user with permission to edit contact points, but not their protected fields, to modify protected settings by switching an integration to a legacy schema version. This can expose stored credentials and redirect alert notifications. The vulnerability affects multiple versions of Grafana Enterprise from 12.4.0 through 13.2.4. It has a high severity with a CVSS score of 7.7.

A critical eval injection vulnerability (CWE-95) exists in the xwiki-pro-macros component of XWiki Remote Macros between versions 1.13 and 1.14.4. The `excerpt-include` macro improperly escapes included page titles and executes excerpt content with macro rights, allowing users with page edit permissions to inject executable macro syntax. This can lead to remote code execution affecting confidentiality, integrity, and availability of the entire XWiki installation. The issue is fixed in version 1.14.5.

A race condition vulnerability exists in OpenVPN ovpn-dco-win versions 0.6.5 through 2.8.13 that allows unprivileged local users to cause a denial of service by crashing the system during the TCP connection process.

Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

CVE-2026-116389 is a deserialization of untrusted data vulnerability in the crossi72 Phoenix Media Rename plugin, affecting versions up to 3.13.5. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 and requires low privileges to exploit without user interaction.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.