A vulnerability in Progress® Telerik® UI for ASP.NET MVC versions 2012.2.710 through 2026.3.811 allows unauthenticated remote attackers to cause denial of service by exploiting a race condition in ClassFactory. The issue involves unsafe updates to a shared class dictionary and emission of non-collectible dynamic assemblies, leading to increased CPU and memory usage and potential application availability degradation. The vulnerability is fixed in version 2026.3.1015.
A vulnerability in In Progress® Telerik® Report Server versions prior to 12.3.26.1110 allows an unauthenticated remote attacker to externally control a system configuration setting. This flaw enables the attacker to influence the server address used by the Report Server when generating links and notifications. Exploitation requires user interaction and can lead to sensitive information disclosure and account takeover.
Revive Adserver versions 6.0.8 and earlier contain a reflected cross-site scripting (XSS) vulnerability in the iframe invocation options. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated user by tricking them into visiting a specially crafted URL. The vulnerability arises because the frame_width and frame_height parameters are included in HTML attributes without proper encoding. The issue is resolved in version 6.0.9 by applying HTML encoding to these parameters in the invocation-option form fields.
The Rooxis RXR-12 Wi-Fi router contains an undocumented backdoor account with UID 0 named 'dg' that uses a firmware-wide default password 'ivanlee'. This account provides root-level access via SSH or local console without requiring device-specific credentials. A firmware update (20260813_c2169ea5) removes this backdoor account and disables root password authentication over SSH. Users can apply this fix through the router's local web interface.
Kendo UI for jQuery versions from 2026.3.1015 up to, but not including, 2026.4.1110 have a vulnerability in the PropertyGrid component where bound property values and items[].description are not encoded by default. This allows an attacker who can control these values to execute JavaScript in the context of a user's browser when viewing the grid, potentially compromising data confidentiality and integrity.
A memory exhaustion vulnerability exists in In Progress® Telerik® UI for ASP.NET Core versions 2015.1.318 through 2026.3.811. Repeated server-side aggregation requests cause dynamic assemblies and load contexts to accumulate, leading to increased process memory consumption. An unauthenticated remote attacker can exploit this if the aggregation endpoint is exposed without authentication, potentially causing denial of service due to resource exhaustion. The issue is fixed in version 2026.3.1015.
The Rooxis RXR-12 Wi-Fi router has an unauthenticated remote code execution vulnerability in the /usr/bin/cloud_manage component. This flaw allows an attacker positioned on the network path with access to a hard-coded cloud endpoint to execute arbitrary commands as root via a specially crafted JSON diagnoseParameter field sent over cleartext HTTP. The issue is fixed in firmware version 20260813_c2169ea5, which can be installed through the router's local web interface.
A blind SQL injection vulnerability exists in Revive Adserver version 6.0.8 and earlier. This flaw allows an authenticated manager, restricted to one agency, to extract arbitrary database values via the banner-zone.php and campaign-zone.php administration pages. The vulnerability arises from inconsistent request-input precedence in permission checks and database queries, enabling an attacker to pass validation with an authorized identifier while injecting a different value into the SQL query. Extracted data can include sensitive information such as password hashes and active session identifiers. Reusing an unexpired administrator session can lead to full administrative access, enabling configuration changes and disruption of ad delivery. The issue is fixed in version 6.0.9 by correcting input handling and excluding cookies from input helpers.
A potential improper permissions vulnerability in Lenovo XiangBangbang could allow a local application to perform unauthorized touch gestures. The vulnerability has a low severity rating and does not impact confidentiality or availability but may allow limited integrity impact. No affected versions or patches are specified.
Kendo UI for jQuery versions from 2022.2.621 up to but not including 2026.4.1111 contain a vulnerability in the DropDownButton and SplitButton components. This vulnerability allows markup injection via the 'id' and 'target' attributes, enabling an attacker who can control these values to inject arbitrary markup including event handlers. The issue is fixed in version 2026.4.1111.
Kendo UI for jQuery versions prior to 2026.4.1111 have a vulnerability in the TabStrip, PanelBar, and Menu widgets where an attacker controlling dataSource fields mapped to spriteCssClass can inject markup with event-handler attributes. This leads to JavaScript execution in the application's origin when a victim loads the affected widget, potentially exposing data and actions available in the victim's authenticated session.
Kendo UI for jQuery versions from 2026.3.1014 up to, but not including, 2026.4.1110 contain a vulnerability in the ActionSheet component where title, subtitle, and header button label values are not properly encoded before rendering. This allows an attacker who can control these values to inject malicious markup that executes JavaScript when a user opens the ActionSheet, potentially compromising data confidentiality and integrity in the user's browser context.
In Progress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function where custom icon markup is parsed into a live DOM before filtering. This allows an attacker who can control the custom icon content to execute JavaScript during icon creation before unsafe elements are removed. The issue was reported in version 2026.3.1015 and fixed in version 2026.4.1110.
A vulnerability in proxygen's HTTP/3 codec allows a remote unauthenticated peer to cause unbounded memory growth and increased CPU usage by sending a very large incomplete non-DATA frame slowly. This can lead to denial of service. The issue affects proxygen versions prior to v2026.11.09.00.
A vulnerability in some Lenovo Tablets allows a third-party application to perform arbitrary file writes with elevated privileges. This flaw could lead to high impact on integrity and availability, though it requires local access and user interaction to exploit.
A vulnerability in proxygen's HTTP/3 session allows a remote unauthenticated HTTP/3 peer to cause excessive memory growth and CPU usage by sending a HEADERS block referencing QPACK dynamic table entries that are never sent, followed by continuous data. This leads to denial of service. The issue affects proxygen versions prior to v2026.11.09.00.
HHVM versions prior to commit 23c061f4e804a51badd5f85227e65185651253b5 contain a vulnerability in request variable parsing. Specifically, when handling query-string and form parameters, HHVM did not verify that appending a nested array succeeded before further processing. This flaw allows a remote, unauthenticated attacker to send crafted GET or POST requests that cause the HHVM server process to crash before application code execution, resulting in denial of service.
A vulnerability in proxygen's QPACK decoder allows a remote unauthenticated HTTP/3 peer to cause unbounded memory consumption by sending an insert instruction with an arbitrarily large string literal on the encoder stream. The decoder only enforces the size limit after receiving the entire literal, leading to memory exhaustion and denial of service. This affects proxygen versions prior to v2026.11.09.00.
An mvfst QUIC server vulnerability allows a remote unauthenticated client to cause unbounded memory growth by sending Handshake-level CRYPTO data after the TLS handshake has progressed past that encryption level. This can lead to denial of service. The issue affects mvfst versions prior to v2026.11.09.00.
repmgr versions 4.0.0 through 5.5.0 contain an OS command injection vulnerability in event notification commands when certain placeholders (%a, %c, %d) are used without proper escaping. This allows a non-superuser database user with write access to node records to execute arbitrary OS commands as the operating system user running repmgr on other cluster nodes. The vulnerability is fixed in repmgr 5.5.1, and operators must adjust their configuration to remove quotes around placeholders after upgrading.