PhpSpreadsheet versions prior to 5.10.0, 3.10.8, 2.4.8, 2.1.19, and 1.30.7 contain a vulnerability in the XmlScanner::scan() method. The scanner's regex pattern only accounts for NULL byte interleaving when detecting <!DOCTYPE declarations, but ISO-2022 escape sequences can bypass this detection. This allows malicious XLSX files with crafted XML to include DOCTYPE declarations that enable XML External Entity (XXE) attacks and Denial of Service (DoS) via quadratic entity expansion. The issue affects all PHP versions for DoS and PHP versions below 8.0 or when LIBXML_NOENT is used for XXE/SSRF. A fix is available in the stated versions.
PhpSpreadsheet's XmlScanner performs two scans on XML content, each followed by an entity decoding callback that runs after pattern checks. This allows a double-encoded entity sequence to bypass detection of dangerous <!DOCTYPE declarations, enabling XML External Entity (XXE) injection and Denial of Service (DoS) via entity expansion. The vulnerability affects PhpSpreadsheet versions >=3.3.0 <3.10.8 and >=4.0.0 <5.10.0. It is exploitable for DoS on all PHP versions and for XXE/SSRF on PHP versions below 8.0 or when LIBXML_NOENT is used. Fixed in versions 3.10.8 and 5.10.0.
A heap buffer overflow vulnerability exists in the Snappy.uncompress*Array typed-array methods of snappy-java before version 1.1.10.9. The issue arises because the methods size the result array by dividing the declared uncompressed byte length by the element size, but native code writes the full byte length, potentially writing up to 7 bytes past the end of the Java array if the length is not a multiple of the element size. This heap corruption can lead to application instability or crashes. The vulnerability is fixed in version 1.1.10.9, where the methods now reject uncompressed lengths that are not multiples of the element size by throwing a SnappyIOException. Users can mitigate by verifying the uncompressed length is a multiple of the element size before calling these methods.
A vulnerability in snappy-java prior to version 1.1.10.9 allows JVM crashes due to unchecked array range parameters in Snappy.arrayCopy and related stream read/write methods. The flaw arises from native memcpy calls without validating offsets and lengths, leading to out-of-bounds memory access and JVM crashes. This issue has been fixed in version 1.1.10.9 by adding proper range checks.
Artalk versions prior to 2.10.1 have a server-side request forgery (SSRF) vulnerability that can be exploited without authentication. Remote attackers can submit anonymous comments to the /api/v2/comments endpoint with a crafted page_key pointing to internal URLs. The server fetches the URL to retrieve the page title with only scheme validation, allowing attackers to read internal page titles via the public comment list. This vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-15586 is a vulnerability in İdvlabs Software and Consulting Services Inc. Ontime that allows brute force attacks due to improper restriction of excessive authentication attempts. The issue affects versions of Ontime up to the publication date 2026-10-27. The vendor was contacted but did not respond to the disclosure. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-92377 is a high-severity vulnerability in TeamViewer Full Client and Host for Windows prior to version 15.82. It involves improper access control in the Patch Management update mechanism, allowing a local authenticated attacker with low privileges to execute arbitrary code with SYSTEM privileges by supplying a signed executable through a forged IPC response. The issue is fixed in versions 15.82, 15.64.10 (Legacy Windows 7 & 8), 14.7.48868, and 13.2.36231.
CVE-2026-92375 is an improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host versions prior to 15.83 and the Remote Management Monitoring component prior to 26.10.1. This flaw allows a local authenticated attacker with low privileges to execute scripts with SYSTEM or root privileges. The vulnerability has a high severity with a CVSS score of 7.8. Fixed versions include 15.83 and 26.10.1 among others.
Nodemailer versions from 3.0.0 up to but not including 10.0.13 contain a vulnerability in the SMTP client where certain regular expressions used to detect SMTP AUTH mechanisms cause quadratic backtracking. This leads to a denial of service by blocking the Node.js event loop during the EHLO response parsing if the server returns a crafted response with long whitespace runs and no matching mechanism. The vulnerability can be triggered pre-authentication by an attacker controlling or influencing the SMTP server or man-in-the-middling the connection before STARTTLS. A fix is available in Nodemailer version 10.0.13.
The WekaClassifier component in NLTK improperly handles caller-controlled model file paths by passing them directly to the weka Java VM without validating them against NLTK's path security enforcement. This allows an attacker to specify arbitrary file paths for model saving and loading, enabling arbitrary file writes and reads outside the intended data root directories. This vulnerability bypasses the pathsec containment measures introduced in a prior advisory (CVE-2026-81726) and affects NLTK versions prior to 3.10.4.
PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
A critical stack-based buffer overflow vulnerability exists in HiRDB Server versions 9 and 10 within specified version ranges. The flaw allows for remote exploitation without privileges or user interaction, potentially leading to high confidentiality and integrity impact, and low availability impact.
A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This vulnerability has a critical severity with a CVSS score of 9.4, indicating it can be exploited remotely without privileges or user interaction, potentially leading to high confidentiality and integrity impact and some availability impact.
A critical vulnerability identified as CVE-2026-82116 affects multiple versions of HiRDB Server. The flaw involves missing authentication for critical functions, allowing unauthenticated attackers to potentially execute unauthorized actions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Affected versions include HiRDB Server Version 10 from 10-00 before 10-12-01, and various releases of Version 9 and its variants up to specified builds. No patch or remediation information is currently provided.
A critical stack-based buffer overflow vulnerability exists in HiRDB Server versions 9 and 10, affecting multiple sub-versions. The flaw allows for remote exploitation without privileges or user interaction, potentially leading to full system compromise.
A stack-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This vulnerability has a critical severity with a CVSS score of 9.4, indicating it can be exploited remotely without privileges or user interaction to cause high confidentiality and integrity impact, and low availability impact.
CVE-2026-105323 is a reflected cross-site scripting (XSS) vulnerability in Kulga News Software versions from 26.7.4 up to but not including 26.10.0. This flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity impact primarily affecting confidentiality and integrity with no impact on availability. A fix is available in version 26.10.0.