An out-of-bounds write vulnerability exists in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi due to missing input validation. This flaw could allow an attacker to cause a denial of service on the affected communication device. The vulnerability has a medium severity rating with a CVSS score of 6.9. No patch or remediation information is currently available.
An improper privilege management vulnerability exists in the SpaceCom and Space Battery pack SP with WiFi, which could allow an attacker with limited privileges to escalate their privileges. This vulnerability is identified as CVE-2026-97361 and has a high severity rating with a CVSS score of 8.5. No specific affected versions or patches are currently documented.
Omnispace Agora Project versions up to 26.10.0 have a broken access control vulnerability in the isAutor() function. This function grants access rights based solely on object authorship without verifying if the user still belongs to the object's space. As a result, former members who authored objects can retain unauthorized read access after removal, causing persistent information disclosure.
CVE-2026-97358 is a high-severity vulnerability in SpaceCom where inclusion of web functionality from an untrusted source could lead to remote code execution. The vulnerability is publicly known but no exploits in the wild have been reported. No affected versions or patch information are provided.
EdgeEver versions from 1.9.0 up to but not including 2.13.0 contain a stored cross-site scripting (XSS) vulnerability in the backup restore endpoint. This flaw allows authenticated users to exploit the PUT /api/v1/restores/json/resources/:id endpoint by submitting a resource of kind image with a text/html MIME type without proper validation. Exploitation can lead to victim browsers executing malicious scripts that mint non-expiring API tokens, granting attackers read and write access to the victim's notes.
NginxPulse versions from 1.5.0 up to but not including 1.6.26 contain an unauthenticated SQL injection vulnerability in the /api/stats/:type endpoint. This flaw allows remote attackers to manipulate the id and locationType parameters to execute arbitrary SQL commands. Exploitation can lead to reading database contents and reading or writing server files via PostgreSQL superuser functions.
Dromara free-fs versions 2.0.1 through 2.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows registered users to upload HTML files that are served inline as text/html, enabling script execution in the context of the application. Attackers can exploit this by sending victims a crafted preview link, which can lead to exposure of the victim's files and account information via API calls.
PMail versions 2.5.0 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts via unsanitized HTML in the /api/email/send endpoint. These scripts can execute when administrators view the message, potentially allowing attackers to perform privileged API actions such as changing passwords and taking over accounts.
Keep versions 0.34.10 through 0.55.0 contain a blind SQL injection vulnerability in the CEL-to-SQL converter. This flaw allows authenticated users with read:alert permission to craft CEL expressions that exploit unescaped bracket-indexed JSON keys in JSON path expressions for SQLite, PostgreSQL, and MySQL. Exploitation can lead to unauthorized extraction of other tenants' alerts and password hashes by using result counts as a boolean oracle.
Tactical RMM versions 0.17.0 through 1.6.1 have an arbitrary file read vulnerability in the /reporting/templates/preview/ endpoint. This occurs because WeasyPrint processes file:// links in user-supplied templates and embeds the referenced files into generated PDFs. Users with report management permissions can exploit this to read sensitive files, including the Django SECRET_KEY, which is reused as the NATS password, enabling them to execute runscript commands on all managed agents.
Seafile SeaDoc converter versions 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contain an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a public share token to execute arbitrary code by supplying an absolute filename to a specific API endpoint, leading to extraction of a ZIP file into the Python library path and subsequent module import triggering code execution.
FileCodeBox versions 2.2.1 through 2.8.4 have a stored cross-site scripting (XSS) vulnerability in the renderMarkdownPreview function. This flaw occurs because the function returns unsanitized text when the marked parser throws an error. Unauthenticated attackers can exploit this by sharing text containing thousands of nested blockquote markers followed by malicious HTML payloads, which execute scripts that steal the admin token from localStorage.
Dromara free-fs versions 2.0.1 through 2.3.1 have a missing authentication vulnerability in the FileStreamController.preview endpoint. This flaw allows unauthenticated attackers to download stored files by using a file ID obtained from share listings or preview links. The vulnerability enables unauthorized access to any user's or workspace's files without requiring authentication.
PMail versions 2.9.1 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability in the /attachments/{id}/{cid} endpoint. This endpoint returns email attachments with the sender-supplied Content-Type after rewriting cid references into attachment links. Unauthenticated SMTP senders can exploit this by sending a text/html attachment and a page-covering cid link, causing the recipient's webmail session to execute malicious scripts, potentially allowing password changes including for administrators.
Dromara free-fs versions 2.0.1 through 2.3.1 have a vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes. This occurs via the PUT /apis/user/forget-password endpoint, where attackers can request a reset code for a known email and submit unlimited guesses within the code's 300-second validity period. Successful exploitation enables attackers to set a new password and take over user accounts.
Dromara free-fs versions 2.0.1 through 2.3.1 have an authorization bypass vulnerability. This flaw allows attackers to access code-protected shares without providing the required share code, as the enforcement is only done client-side. Attackers who know a share ID can list and download files from these shares, including preview-only shares, without authorization.
paicoding version 1.0.3 has a missing authorization vulnerability in the ArticleRestController's article detail endpoint. This flaw allows unauthenticated attackers to access restricted articles, including paid, login-only, member-only, and draft content, by enumerating article IDs via the GET /article/api/data/detail/{articleId} endpoint.
SurveyKing versions 1.13.0 through 1.13.2 have a stored cross-site scripting (XSS) vulnerability. The server accepts respondent-supplied survey snapshots, and the frontend renders survey titles using innerHTML, allowing malicious scripts embedded in these snapshots to execute in an administrator's browser. This vulnerability can be triggered by anonymous respondents submitting crafted snapshots with event handlers like img onerror. The CVSS score is 6.1, indicating a medium severity impact.
SurveyKing version 1.13.2 has a missing authorization vulnerability in its result lookup feature. The anonymous survey view leaks the lookup configuration, including the password. Additionally, the lookup password check is bypassed when no answer is provided. This allows unauthenticated attackers with access to a public survey link to inject a wildcard character into the query, enabling them to retrieve all survey responses, including hidden fields.
DjangoBlog versions 2.0.0.0 through 2.1.0.0 contain a stored cross-site scripting (XSS) vulnerability. The issue arises because the class_filter comment sanitizer improperly allows event-handler attributes on certain HTML tags, enabling authenticated commenters to inject scripts that execute automatically when a page is viewed, including by administrators.