CVE-2026-118257 is a high-severity cross-site scripting (XSS) vulnerability in the vue-i18n internationalization plugin for Vue.js. The flaw affects versions 9.14.5, 10.0.8, and versions from 11.1.10 up to but not including 11.4.14, as well as 12.0.0-alpha.4 up to but not including 12.0.0-alpha.5. The vulnerability arises because the sanitizeTranslatedHtml() function escapes markup and event-handler text inside an iframe srcdoc attribute but leaves the srcdoc attribute active, allowing browsers to parse attacker-controlled content as same-origin nested HTML. This can lead to script execution when escapeParameter is enabled and translations are rendered as HTML via v-html. The issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
A cross-site scripting (XSS) vulnerability exists in the vue-i18n internationalization plugin for Vue.js versions from 9.0.0-beta.5 up to but not including 11.4.14 and from 12.0.0-alpha.1 up to but not including 12.0.0-alpha.5. When the escapeParameter (escapeParameterHtml in the Legacy API) option is enabled, named interpolation values are not properly escaped if both list and named values are supplied in the same translation call. This can allow attacker-controlled HTML markup injection, potentially leading to phishing or script execution when combined with other issues. The vulnerability is fixed in versions 11.4.14 and 12.0.0-alpha.5.
MIME::Parser versions before 5.521 for Perl have a vulnerability where no limit is set on the number of message parts by default, which can lead to memory exhaustion. The max_parts option defaulted to -1, disabling limits and allowing the parser to build an entity for every part in a message regardless of quantity. Version 5.521 introduces default limits of max_parts to 1000 and max_depth to 64 to mitigate this issue.
The Drupal module 'bulk_update_user_roles' has a vulnerability that allows unauthorized users to access the bulk role assignment form. This form does not restrict access properly, potentially enabling users without the correct permissions to assign or remove roles on multiple user accounts. However, exploitation requires the attacker to already have the 'administer users' permission, which limits the risk. The issue is fixed in version 1.0.5.
MIME::Words versions before 5.521 for Perl contain an inefficient algorithmic complexity vulnerability in the decode_mimewords function. This flaw allows memory exhaustion via repeated "=?" sequences. Each incomplete encoded word starting with "=?" causes an error message containing the entire input string to be appended repeatedly, leading to large memory consumption. From version 5.518, MIME::Parser decodes every multipart boundary similarly, enabling a remote sender to exhaust memory with a crafted Content-Type header.
The AI module for Drupal includes a submodule called AI Automator that automatically fills out fields using AI based on other fields. A vulnerability exists because the module does not sufficiently check access permissions to text formats, allowing users to author field data in text formats they should not have access to. This could lead to unauthorized content creation or manipulation. Fixed versions 1.4.11 and 1.5.2 address this issue.
The Drupal AI module has a cross-site scripting (XSS) vulnerability due to insufficient sanitization of certain HTMX attributes. This flaw affects versions prior to 1.4.11 and versions from 1.5.0 up to but not including 1.5.2. Fixed versions 1.4.11 and 1.5.2 address this issue.
The Drupal AI integration module has a vulnerability where audio files from speech-to-text requests are stored in a shared temporary directory without deletion. An attacker with read access to this directory could access audio submitted by other users. However, this requires the attacker to have read permissions on the temporary directory, which is typically restricted. The issue is fixed in versions 1.4.11 and 1.5.2.
The Drupal AI module's AI Search submodule has a vulnerability where cached search results may expose titles and fields of unpublished or access-restricted content to unauthorized users under certain configurations. This occurs because the Search API caches results without considering access restrictions, potentially leaking sensitive content. The vulnerability only affects setups using the AI Search submodule with Search API result caching enabled and requires that a user with access to restricted content has previously run the same search within the cache lifetime. Retrieval-augmented generation tools and custom Search API queries are not affected. Fixed versions 1.4.11 and 1.5.2 address this issue.
The Drupal AI module includes an AI Chatbot submodule that under certain configurations does not properly filter user input before rendering, leading to a potential cross-site scripting (XSS) vulnerability. Exploitation requires attacker access to administer blocks, limiting the attack surface. Fixed versions 1.4.11 and 1.5.2 address this issue.
CVE-2026-106079 is an OS Command Injection vulnerability in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker with configuration write privileges to execute arbitrary commands as root via the YANG configuration interface. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS v3.1 score is 8.8, indicating high severity.
CVE-2026-103408 is a stack-based buffer overflow vulnerability in the DHCP client of Juniper Networks Session Smart Router. It allows an unauthenticated attacker on the local network to execute remote code by sending a malicious DHCP reply. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. It has a high severity with a CVSS score of 8.8.
CVE-2026-103407 is a path traversal vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ConfigDirector component. It allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-103406 is a critical OS command injection vulnerability in the AutomatedProvisioner component of Juniper Networks Session Smart Conductor. It allows a remote attacker to execute arbitrary commands with root privileges by sending a specially crafted salt minion ID. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The flaw has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-103405 is an injection vulnerability in the web server component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker to inject arbitrary HTTP headers through unsanitized request body parameters. The flaw is classified as CWE-74, indicating improper neutralization of special elements in output used by a downstream component. This vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS 3.1 base score is 5.8, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. No known exploits are reported in the wild.
CVE-2026-103404 is a vulnerability in Juniper Networks Session Smart Conductor's RoutingManager component where incorrect permission assignment allows a local user to access sensitive routing credentials. This occurs through triggering processes that write to the /tmp directory. The issue affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The vulnerability has a CVSS score of 6.8, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.
CVE-2026-103403 is an OS Command Injection vulnerability in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor. It allows an attacker with limited privileges to execute arbitrary commands and delete files by exploiting improper neutralization of special elements during audit rule deletion. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. It has a high severity with a CVSS score of 8.8.
CVE-2026-103391 is an out-of-bounds write vulnerability in the TCP proxy/optimization path of Juniper Networks Session Smart Router. It allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash by sending a transit TCP packet with a specially crafted TCP option length. The vulnerability affects multiple versions prior to fixed releases 7.0.5, 7.1.7, and 7.2.3. The CVSS score is 5.3, indicating a medium severity level.
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
A deserialization of untrusted data vulnerability exists in Phoenix Media Rename (phoenix-media-rename) up to version 3.13.5. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability is identified as CVE-2026-116389 with a CVSS score of 8.8, indicating a high severity risk.