Threat database

CVE-2026-102141 is a vulnerability in Kiteworks Core cluster-management operations where file paths supplied were not validated. This allows an attacker with root access on one cluster node to write files as root onto another node, potentially causing execution there. Exploitation requires high privileges (root) on a backend node and the presence of a pending software patch on the target node. The vulnerability affects Kiteworks Core versions prior to 9.5.1.

CVE-2026-102142 is a high-severity vulnerability in the Kiteworks Core appliance where a system notification template is processed by a template engine that evaluates expressions within the template body. An authenticated System Administrator can craft a malicious template that, when the notification is sent, executes operating system commands on the appliance. This vulnerability affects Kiteworks Core versions from initial up to but not including 9.5.1.

Kiteworks Core versions prior to 9.5.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated user to submit malicious content that executes arbitrary JavaScript in the context of another user's authenticated session when viewed. Such exploitation could enable actions on behalf of the victim, including potential account takeover of users with elevated privileges. Exploitation requires the victim to view the malicious content. The vulnerability has a high severity rating with a CVSS score of 8.7.

CVE-2026-102147 is a critical stored cross-site scripting (XSS) vulnerability in Kiteworks Core. An unauthenticated attacker can inject malicious content that executes arbitrary JavaScript in the session of an administrator viewing the affected page. This can lead to full administrative control, including creating new admin accounts. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. No patch information is provided in the available data.

CVE-2026-102145 is a vulnerability in Kiteworks Core where an authenticated administrator can exploit improper neutralization of CRLF sequences (CRLF Injection). This flaw allows the server to issue requests to internal network services that should not be accessible through the interface. The vulnerability does not lead to code execution by itself.

Kiteworks Core versions prior to 9.5.0 contain an OS Command Injection vulnerability. This flaw allows an authenticated administrator to upload a specially crafted configuration package that is not properly validated. Exploiting this vulnerability could lead to arbitrary command execution on the underlying system with potentially elevated privileges.

Kiteworks Core versions prior to 9.5.0 contain a path traversal vulnerability (CWE-22) in an administrative export feature. This flaw allows an authenticated administrator to write files to arbitrary locations on the host system, which could lead to command execution on the appliance. Exploitation requires valid administrative credentials and access to the vulnerable export function.

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

Kiteworks Core versions prior to 9.5.0 contain a stored SQL injection vulnerability in an administrative reporting feature. This flaw allows an authenticated administrator to read sensitive database information and potentially disrupt service availability. Exploitation requires valid administrative credentials and access to the vulnerable reporting function.

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 31.0.00 is sufficient to fix this issue. The identifier of the patch is 07e719368eae8dfb4e22e19424ceab6074164ebc. It is recommended to upgrade the affected component.

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

CVE-2026-62998 is a medium severity vulnerability in the REDAXO PHP-based content management system core. Prior to version 5.21.2, the function rex_list::getSortColumn() improperly accepts a sort request parameter without verifying if the requested column is registered as sortable. This allows an authenticated backend user to cause the system to order query results by unauthorized columns, potentially exposing sensitive information such as user passwords through error-based enumeration. The issue is fixed in REDAXO version 5.21.2.

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVE-2026-63001 is a cross-site scripting (XSS) vulnerability in the REDAXO PHP content management system core. Prior to version 5.21.2, the mediaIsInUse() handler in the media_manager addon inserts unescaped type names into backend warning HTML. An administrator with Media Manager access can inject malicious HTML into a type name, which executes in another administrator's browser during media deletion. This can lead to session theft or unauthorized backend actions. The vulnerability is fixed in REDAXO version 5.21.2.

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.

CVE-2026-91130 is a critical cross-site scripting (XSS) vulnerability in Home Assistant core prior to version 2026.7.0. The issue arises from improper escaping of entity names interpolated into ECharts tooltip HTML in the Statistics Graph card, allowing script execution when a viewer hovers over a data point. This affects Mean, State, Sum, and Change fields in the default Line chart configuration but not Bar charts. The vulnerability requires authentication or control over an integration that supplies entity names. It is fixed in version 2026.7.0.