OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability where inbound edge gateway events do not undergo proper realm or gateway-descendant authorization. This allows an attacker controlling a registered gateway to manipulate event asset IDs to overwrite or delete assets across different realms, breaking tenant isolation.
OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows authenticated users to access gateway tunnel information from other realms. This can expose internal target hosts, ports, and routing data by exploiting the getGatewayActiveTunnelInfos endpoint with manipulated parameters.
OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows realm administrators to impersonate gateways in other realms. This occurs because the GatewayService only verifies the gateway ID without validating the associated realm. Attackers with WRITE:ADMIN privileges in one realm can create a service user named after another realm's gateway ID, enabling them to overwrite assets and establish SSH tunnels into the target realm's local network. The vulnerability has a low CVSS 4.0 base score of 2.1 and does not have known exploits in the wild.
CVE-2026-63442 is a vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It involves improper output neutralization for logs, allowing unauthenticated attackers to inject carriage-return and line-feed characters into the WebGUI login username field. This injection manipulates syslog-ng log processing to forge authentication events, enabling attackers to block legitimate IP addresses by adding them to the sshlockout PF table or bypass password-guessing lockout mechanisms. The issue is fixed in version 26.1.11.
CVE-2026-58390 is a cross-site scripting (XSS) vulnerability in the OPNsense core firewall platform prior to version 26.1.11. It affects the OpenVPN connection-status dashboard widget and view, where a client common_name is inserted into HTML attributes without proper quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a username containing a double quote. An authenticated client can inject script that executes in an administrator's session when viewing the dashboard or connection-status page. The vulnerability allows reading config.xml, invoking privileged APIs, resetting the root password, and obtaining root command execution. This issue is fixed in version 26.1.11.
A cross-site scripting (XSS) vulnerability exists in OPNsense core prior to version 26.1.11. The vulnerability occurs because the certificate description field in the SSL Certificate selector does not properly escape HTML metacharacters, allowing a user with the page-system-certmanager privilege to inject markup. This markup executes when another user with access opens the System Settings Administration page. The issue is fixed in version 26.1.11.
CVE-2026-58392 is a cross-site scripting (XSS) vulnerability in the OPNsense core firewall and routing platform. The issue occurs on the NTP GPS page prior to version 26.1.11, where user-supplied input is improperly neutralized, allowing stored XSS. An attacker with page-services-ntp-gps privilege can inject malicious scripts that execute in the context of other users viewing the GPS page, potentially enabling theft of CSRF tokens and execution of authenticated actions. This vulnerability is fixed in version 26.1.11.
CVE-2026-58395 is an XPath Injection vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It allows a user with certain module privileges to send crafted tokens to delete endpoints, causing XPath expressions to expose configuration data across multiple modules without modifying the configuration. The issue is fixed in version 26.1.11.
A path traversal vulnerability (CWE-22) exists in OPNsense core prior to version 26.1.11. The OpenVPN Client Specific Override common_name field improperly accepts path traversal sequences, allowing an authenticated user with Client Specific Override privileges to cause OpenVPN configuration files to be written outside the intended directory. This occurs because the value is concatenated into a file path without normalization or basename checks. Exploitation requires triggering a matching OpenVPN client-connect or authentication event. The vulnerability is fixed in version 26.1.11.
CVE-2026-57155 is a critical path traversal vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It arises from improper validation of a CSV country_code value used in constructing output filenames during GeoIP alias imports. An attacker with Firewall Alias Edit privileges can exploit this to write arbitrary files as root, potentially leading to full firewall compromise via cron job execution. The issue is fixed in version 26.1.11.
A cross-site scripting (XSS) vulnerability exists in OPNsense core prior to version 26.1.11. The issue arises from improper encoding of stored category names and alias descriptions placed into HTML title attributes, allowing injection of script code. An authenticated user with Firewall Categories or Firewall Alias Edit privileges can exploit this by crafting malicious input that executes in the session of an administrator or other user viewing the affected Rules or NAT page. This can lead to unauthorized actions performed with the victim's privileges. The vulnerability is fixed in version 26.1.11.
CVE-2026-53582 is an XML Injection vulnerability in the OPNsense core Trust module prior to version 26.1.10. It allows users with CA Manager or Certificate Manager privileges to inject crafted refid values into XPath expressions, enabling them to recover sensitive configuration data character by character. Exposed data may include password hashes, API credentials, private keys, and VPN key material, potentially leading to privilege escalation and compromise of other security domains. The issue is fixed in OPNsense version 26.1.10.
Cheshire Cat AI core versions up to 2.0.23 have a stored cross-site scripting (XSS) vulnerability in the uploads plugin. Authenticated users can upload HTML files without type restrictions via POST /uploads. This allows attackers to craft URLs that execute scripts in the application origin when visited by signed-in users, potentially exposing their access_token cookies, including those of administrators.
CVE-2026-103542 is a server-side request forgery (SSRF) vulnerability in Form Tools up to version 3.1.1. The flaw exists in the smart_fill function within the AJAX Endpoint component, specifically in /global/code/actions.php. This vulnerability allows remote attackers to manipulate the url argument to induce the server to make unintended requests. Exploit code has been published, but no vendor response or patch is currently available.
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-103540 is a medium severity vulnerability in formtools.org Form Tools versions 3.1.0 and 3.1.1. It involves improper neutralization of special elements in the template engine within the Clients::updateClientSettingsTab function. This flaw allows remote attackers to manipulate the page_titles argument, potentially leading to security issues. The vulnerability has been publicly disclosed, but no patch or vendor response has been confirmed yet.
CVE-2026-102107 is a medium severity vulnerability in Kiteworks Core involving an authorization bypass in the file-request feature. An authenticated user can send a request that appears to originate from another user because the server does not verify authorization properly. Exploitation requires the feature to be enabled for the attacker and the targeted recipient to act on the request. This flaw could allow solicitation of files or information under a trusted identity.
CVE-2026-102110 is a medium severity vulnerability in Kiteworks Core where an endpoint used during initial appliance setup lacks authentication and does not enforce its intended state precondition. This allows an unauthenticated network attacker to repeatedly trigger the privileged activation process during the initial activation window, potentially disrupting setup and leaving the appliance incompletely configured. The vulnerability is only exploitable during the first-time activation of the appliance and is not accessible afterward.
CVE-2026-102111 is a vulnerability in Kiteworks Core where the software does not enforce the maximum allowed value for a configurable security-policy setting. An authenticated administrator can set this value beyond its intended range, causing the associated security control to never activate. Despite this, the control appears enabled in the administrative interface and audit logs, effectively rendering it silently ineffective.
CVE-2026-102112 is a privilege escalation vulnerability in Kiteworks Core that allows an attacker with existing code execution as an unprivileged backend service account to escalate privileges to root and execute arbitrary commands with highest privileges. Exploitation requires local access to the service account. The vulnerability is due to improper neutralization of special elements used in OS commands (CWE-78).