Search: 5.1.8.7

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.

CVE-2026-106077 is a high-severity vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges, potentially exposing sensitive data. A patch is available for this issue.

CVE-2026-106076 is a critical SQL injection vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows an authenticated organization-transfer peer to inject SQL commands into the source server's configuration database, potentially enabling cross-tenant data access and remote code execution as the PostgreSQL service account.

CVE-2026-77173 is an improper access control vulnerability in Nextcloud Files Confidential affecting versions 3.3.0 through 5.0.0. It allows a user to create a .docx or .odt file with a '#' character in the filename containing confidential information, such as credit card numbers, without the file being marked as confidential.

CVE-2026-112709 is a critical heap-based buffer overflow vulnerability in the WatchGuard Fireware OS authentication service. It affects versions 2025.1 up to but not including 2026.4, 12.0 up to but not including 12.12.4, and 12.0 up to but not including 12.5.22. An attacker who can control or intercept traffic to the configured Active Directory server can exploit this flaw by returning a specially crafted response, potentially causing denial of service or arbitrary code execution. The vulnerability has a CVSS 4.0 score of 9.2, indicating high impact on confidentiality, integrity, and availability. Fixed versions are available starting from 2026.4, 12.12.4, and 12.5.22 respectively.

CVE-2026-93434 is an XPath injection vulnerability in WatchGuard Fireware OS affecting the SSH authentication process. It allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting specially crafted requests. The vulnerability affects multiple versions prior to 12.5.22, 2026.4, and 12.12.4. It has a high severity score of 8.7 and has been officially fixed in the specified versions.

CVE-2026-90442 is a stack-based buffer overflow vulnerability in the certd process of WatchGuard Fireware OS. It affects versions 2025.1 up to but not including 2026.4, 12.0 up to but not including 12.12.4, and 12.0 up to but not including 12.5.22. An authenticated attacker with access to the Firebox management interface can exploit this flaw by sending a specially crafted request, causing the certificate management service to crash and potentially allowing arbitrary code execution. The vulnerability has a high severity with a CVSS 4.0 score of 8.6. Fixed versions are 2026.4, 12.12.4, and 12.5.22.

CVE-2026-82332 is an improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process. It allows a local, unauthenticated attacker on the appliance to hijack another user's active MFA session by sending a specially crafted request and tricking the victim into accepting an MFA push notification. The vulnerability affects Fireware OS versions from 2025.1 up to but not including 2026.4, and versions from 12.7 up to but not including 12.12.4. A fix is available in versions 2026.4 and 12.12.4. The CVSS 4.0 base score is 5.6, indicating medium severity.

PhpSpreadsheet versions from 5.5.0 up to and including 5.9.0 contain a server-side request forgery (SSRF) vulnerability in the Worksheet\Drawing::setPath() method. The vulnerability arises because the external image URL whitelist check is applied only once on the initial URL, and HTTP redirects are followed without re-validation, allowing an attacker to redirect requests to internal or otherwise restricted endpoints. This results in a blind SSRF where the server issues internal GET requests without exfiltrating response content. A fix is available in version 5.10.0.

PhpSpreadsheet's ODS reader has an unbounded number-rows-repeated attribute handling flaw that can cause memory exhaustion. When processing an OpenDocument Spreadsheet (.ods) file, the reader expands the number-rows-repeated attribute without an upper bound, potentially materializing millions of cells from a small file. This leads to PHP fatal out-of-memory errors. All maintained versions up to 5.9.0 are affected. The vulnerability is fixed in versions 5.10.0, 3.10.8, 2.4.8, 2.1.19, and 1.30.7.

PhpSpreadsheet versions prior to 5.10.0, 3.10.8, 2.4.8, 2.1.19, and 1.30.7 contain a vulnerability in the XmlScanner::scan() method. The scanner's regex pattern only accounts for NULL byte interleaving when detecting <!DOCTYPE declarations, but ISO-2022 escape sequences can bypass this detection. This allows malicious XLSX files with crafted XML to include DOCTYPE declarations that enable XML External Entity (XXE) attacks and Denial of Service (DoS) via quadratic entity expansion. The issue affects all PHP versions for DoS and PHP versions below 8.0 or when LIBXML_NOENT is used for XXE/SSRF. A fix is available in the stated versions.

PhpSpreadsheet's XmlScanner performs two scans on XML content, each followed by an entity decoding callback that runs after pattern checks. This allows a double-encoded entity sequence to bypass detection of dangerous <!DOCTYPE declarations, enabling XML External Entity (XXE) injection and Denial of Service (DoS) via entity expansion. The vulnerability affects PhpSpreadsheet versions >=3.3.0 <3.10.8 and >=4.0.0 <5.10.0. It is exploitable for DoS on all PHP versions and for XXE/SSRF on PHP versions below 8.0 or when LIBXML_NOENT is used. Fixed in versions 3.10.8 and 5.10.0.

A regular expression denial of service (ReDoS) vulnerability exists in Datadog's dd-trace-py library affecting the URL query string obfuscation pattern used in HTTP tracing integrations. The vulnerable regex can cause excessive CPU consumption and stall request processing when handling certain attacker-controlled inputs, leading to denial of service. This issue affects ddtrace versions from 1.5.0 up to but not including 3.19.9, and from 4.0.0 up to but not including 4.15.6. A fix is available in versions 3.19.9 and 4.15.6. Workarounds involve setting environment variables to use a fixed regex pattern. The vulnerability is enabled by default in affected HTTP integrations that include query strings in URL span tags.

PowerProtect Data Domain versions 7.7.1.0 through 8.7, including certain LTS2024, LTS2025, and LTS2026 releases, contain a Relative Path Traversal vulnerability in the certificate handling. This flaw allows a high privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.

A vulnerability in Octopus Server allows a user with permission to upload a malicious NuGet package to deploy a script step that executes outside of the intended parent directory. This could lead to unintended script execution paths. The issue affects unspecified versions of Octopus Server and has a medium severity rating with a CVSS score of 5.1.

mcp-ffmpeg versions through 1.0.5 have an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by providing specially crafted videoPath or outputDir inputs to certain tools. The vulnerability arises from improper handling of these inputs in child_process.exec calls, enabling command injection via shell metacharacters.

Artalk versions prior to 2.10.1 have a server-side request forgery (SSRF) vulnerability that can be exploited without authentication. Remote attackers can submit anonymous comments to the /api/v2/comments endpoint with a crafted page_key pointing to internal URLs. The server fetches the URL to retrieve the page title with only scheme validation, allowing attackers to read internal page titles via the public comment list. This vulnerability has a medium severity with a CVSS score of 5.3.

A heap out-of-bounds read vulnerability exists in zchunk versions before 1.5.5 in the read_preface() function. This flaw occurs because the function passes the total header length instead of the remaining bytes to compressed integer parsing functions, allowing crafted .zck files to cause reads beyond the heap buffer and crash the application.

A vulnerability in Keepnet Labs Cybersecurity Inc.'s Agentic AI / Agentic Ally allows an attacker to bypass authentication by spoofing. This flaw affects versions before commit 0ef61f2e. The vulnerability has a high severity score of 7.5 and impacts confidentiality without requiring privileges or user interaction.

A denial of service vulnerability exists in a2aproject a2a-go up to version 2.4.0 in the Cancel function of the Distributed Manager component. This vulnerability can be exploited remotely and leads to service disruption. Upgrading to version 2.5.0 resolves the issue.