CVE-2026-61898 is an OS command injection vulnerability in Canonical's accountsservice affecting certain Ubuntu-specific language helper scripts. The vulnerability arises because these scripts treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input and interpolate it unescaped into a GNU sed replacement expression. This allows an attacker to inject arbitrary shell commands executed with root privileges via the SetLanguage D-Bus method. The issue affects multiple specific versions of accountsservice prior to 23.13.9-8ubuntu7. The vulnerability has a high severity score of 7.8 CVSS v3.1.
CVE-2026-61897 is a local privilege escalation vulnerability in Ubuntu's accountsservice prior to version 23.13.9-8ubuntu7. The flaw arises because an Ubuntu-specific patch only partially drops privileges before launching language helper scripts, leaving the real user ID as root. This allows a shell spawned by the helper script to inherit root privileges and potentially regain full root access. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-70383 is a path traversal vulnerability in the Estonian Information System Authority (RIA) DigiDoc4 client. It affects versions from 4.0.0 up to but not including 4.11.0. The flaw allows improper limitation of a pathname to a restricted directory, potentially enabling unauthorized file access. The vulnerability has a high severity score of 8.4 (CVSS 4.0). No official patch or remediation details are provided in the input data.
CVE-2026-74018 is a critical vulnerability in themagnifico52's Warehouse Cargo product that allows subscriber-level users to upload arbitrary files without restriction on file type. This issue affects versions up to and including 2.6.9. The vulnerability can lead to complete system compromise due to its high impact on confidentiality, integrity, and availability.
CVE-2026-74016 is a critical vulnerability in themagnifico52 Smart Cleaning versions up to 4.8.6 that allows arbitrary file upload due to unrestricted upload of files with dangerous types. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.
CVE-2026-14953 is a medium severity vulnerability in Frauscher Sensortechnik FDS 102 versions 2.11.0 through 2.13.3. It allows a low-privileged remote attacker to enumerate all configured users and determine which accounts have elevated privileges via the /api/user/fetch-all.php endpoint. This is a direct request (forced browsing) vulnerability categorized under CWE-425.
CVE-2026-14952 is a high-severity vulnerability in Frauscher Sensortechnik's FDS 102 product. It allows unauthenticated remote attackers to access sensitive files on the FDS Web server without valid authentication. Specifically, attackers can retrieve backup archives and other files containing detailed railway signaling and track layout information over HTTP. This exposure of critical infrastructure data poses significant confidentiality risks.
CVE-2026-14951 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in Frauscher Sensortechnik FDS 102. A low privileged remote attacker can trick authenticated users into performing unintended actions via malicious web pages. This affects versions 2.0.0 through 2.13.3 inclusive. The vulnerability allows unauthorized state-changing operations in the web interface without direct user consent.
CVE-2026-14950 is a critical vulnerability in Frauscher Sensortechnik's FDS 102 product where an unauthenticated remote attacker with a valid session identifier can continue to use the session after it should have expired. This flaw allows unauthorized continued access to the FDS web interface, increasing the risk from stolen, leaked, shared, or unattended sessions.
CVE-2026-14949 is an authorization vulnerability in Frauscher Sensortechnik FDS 102 that allows a low privileged remote attacker with a valid session to create new user accounts with arbitrary roles, including the highest privilege level. This flaw exists in the user creation functionality exposed via /api/user/add.php. The vulnerability affects versions from 2.11.0 up to and including 2.13.3. The CVSS 4.0 base score is 8.5, indicating high severity.
CVE-2026-14948 is a vulnerability in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3. It allows a low privileged remote attacker to hijack an active administrative session by extracting plaintext session identifiers from downloadable error log archives. This flaw involves the insertion of sensitive information into log files, specifically live session tokens, which can be exploited without knowing the administrator password.
CVE-2026-14947 is a path traversal vulnerability in Frauscher Sensortechnik FDS 102 that allows a high-privileged remote attacker to upload a malicious ZIP archive containing directory traversal sequences (e.g., ../). This enables the attacker to escape the intended extraction directory and write files to arbitrary locations on the server. Improper validation of archive entry paths before writing files to disk can lead to arbitrary code execution and potentially full system compromise. The vulnerability affects versions from 2.8.0 up to and including 2.13.3. The CVSS 4.0 score is 8.6, indicating high severity. No patch or remediation details are provided in the input data.
CVE-2026-14946 is a high-severity vulnerability in Frauscher Sensortechnik FDS 102 that allows a high privileged remote attacker to upload a .php file due to improper file type validation. This uploaded file can then be accessed directly to execute arbitrary code, potentially leading to full system compromise. The affected versions include 2.8.0 through 2.13.3. No patch or remediation information is currently provided.
CVE-2026-76785 is a medium severity SQL injection vulnerability in amirsanni Mini-Inventory-and-Sales-Management-System version 0.1. The flaw exists in the Transaction::getAll function within application/models/Transaction.php, where manipulation of the orderBy or orderFormat arguments can lead to SQL injection. The vulnerability can be exploited remotely. Public exploit code is available, but the vendor has not yet responded or issued a fix.
CVE-2026-11617 is a low-severity vulnerability in Tanium Findings involving improper handling of highly compressed data, also known as a compression bomb. This flaw can cause data amplification leading to denial of service conditions. Tanium has addressed this issue in updated versions of the Findings product.
CVE-2026-75476 is a low-severity vulnerability in Tanium Threat Response involving improper handling of highly compressed data, also known as a compression bomb. This flaw can lead to data amplification issues causing availability impact. Tanium has addressed this vulnerability in specific versions of Threat Response.
Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.