| CVE-2026-106087
|
8.7 |
2026-10-27 |
- |
- |
|
— |
— |
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information. |
| CVE-2026-10756
|
7.7 |
2026-10-27 |
- |
- |
|
— |
— |
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact. |
| CVE-2026-115408
|
5.5 |
2026-10-27 |
1.9 |
3.6 |
|
— |
— |
In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In addition, the "ID only" fallback search runs even when the private key has no `CKA_ID`, so the search template reduces to the public-key class and the ML-KEM key type and the first ML-KEM public key on the token is returned. `Encapsulate()` on the resulting key pair encrypts the fresh shared secret to that key, so its owner — not the holder of the private key the caller looked up — can recover the secret. An attacker who can open an unauthenticated session on the token and plant a public `CKK_ML_KEM` object carrying the victim's `CKA_ID`/`CKA_LABEL` receives the shared secrets for encapsulations performed through the substituted key pair, compromising the confidentiality of those secrets and of everything protected by keys derived from them. The v1 module paths have no ML-KEM support and are not affected. |
| CVE-2026-13162
|
7.7 |
2026-10-27 |
- |
- |
|
— |
— |
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation. |
| CVE-2026-113644
|
5.5 |
2026-10-27 |
- |
- |
|
— |
— |
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2. |
| CVE-2026-90728
|
6.3 |
2026-10-27 |
0.8 |
5.5 |
|
— |
— |
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges. |
| CVE-2026-105323
|
6.1 |
2026-10-27 |
2.9 |
2.8 |
|
— |
— |
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS.
This issue affects Kulga News Software: from v26.7.4 before v26.10.0. |
| CVE-2026-90729
|
6.7 |
2026-10-27 |
1.3 |
5.5 |
|
— |
— |
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. |
| CVE-2026-115216
|
9.1 |
2026-10-27 |
- |
- |
|
— |
— |
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret. |
| CVE-2026-10752
|
4.8 |
2026-10-27 |
2.3 |
2.6 |
|
— |
— |
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled. |
| CVE-2026-41022
|
5.9 |
2026-10-27 |
1.7 |
3.8 |
|
— |
— |
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4. |
| CVE-2026-109995
|
7.2 |
2026-10-27 |
3.9 |
2.8 |
|
— |
— |
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable even against pending or unapproved comments, as the plugin's get_comment() lookup applies no approval-status filter, meaning a payload executes for any visitor loading an avf-layout block bound to the attacker's comment ID before the comment is ever reviewed. |
| CVE-2026-90730
|
6.5 |
2026-10-27 |
3.9 |
2.6 |
|
— |
— |
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. |
| CVE-2026-112362
|
9.1 |
2026-10-27 |
3.9 |
5.2 |
|
— |
— |
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default. |
| CVE-2026-90731
|
4.9 |
2026-10-27 |
1.3 |
3.6 |
|
— |
— |
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
| CVE-2026-41021
|
7.5 |
2026-10-27 |
1.7 |
5.9 |
|
— |
— |
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials. |
| CVE-2026-90732
|
4.9 |
2026-10-27 |
1.3 |
3.6 |
|
— |
— |
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
| CVE-2026-117499
|
3.7 |
2026-10-27 |
1.2 |
2.6 |
|
— |
— |
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write. |
| CVE-2026-56084
|
5.8 |
2026-10-27 |
3.9 |
1.5 |
|
— |
— |
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery. |
| CVE-2026-102800
|
8.7 |
2026-10-27 |
- |
- |
|
— |
— |
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without authentication through com_ajax. The value was stored exactly as submitted instead of being taken from the connection by the server. It was then printed without output escaping in the administrator backend’s “Helpful articles” overview (views/items/tmpl/default.php). $db->quote() was applied on insert, which protects the SQL statement but does nothing for HTML output. There was no CSRF token, no rate limit, and the vote de-duplication keyed on the same attacker-controlled field. |
| CVE-2026-41020
|
7.5 |
2026-10-27 |
1.7 |
5.9 |
|
— |
— |
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device. |
| CVE-2026-4337
|
8.8 |
2026-10-27 |
- |
- |
|
— |
— |
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files. |
| CVE-2026-117541
|
6.9 |
2026-10-27 |
- |
- |
|
— |
— |
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection. |
| CVE-2026-117540
|
8.7 |
2026-10-27 |
- |
- |
|
— |
— |
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes. |
| CVE-2026-117539
|
5.1 |
2026-10-27 |
- |
- |
|
— |
— |
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses. |
| CVE-2026-117538
|
2.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data. |
| CVE-2026-117537
|
2.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session. |
| CVE-2026-117536
|
8.6 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator. |
| CVE-2026-117535
|
5.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator. |
| CVE-2026-117534
|
5.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states. |
| CVE-2026-117533
|
2.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions. |
| CVE-2026-117532
|
9.3 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode. |
| CVE-2026-116900
|
5.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts. |
| CVE-2026-116899
|
7.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices. |
| CVE-2026-116898
|
7.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide. |
| CVE-2026-116897
|
7.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content. |
| CVE-2026-116896
|
7.7 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking. |
| CVE-2026-116895
|
5.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons. |
| CVE-2026-116894
|
2.3 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months. |
| CVE-2026-116893
|
6.1 |
2026-10-27 |
- |
- |
|
— |
— |
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages. |
| CVE-2026-117466
|
8.6 |
2026-10-27 |
- |
- |
|
— |
— |
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. |
| CVE-2026-117341
|
7.7 |
2026-10-27 |
- |
- |
|
— |
— |
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user. |
| CVE-2026-116870
|
8.7 |
2026-10-27 |
- |
- |
|
— |
— |
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation. |
| CVE-2026-110737
|
2.3 |
2026-10-27 |
- |
- |
|
— |
— |
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 14.14.0 - 14.14.7
Vaadin 23.6.0 - 23.6.16
Vaadin 24.4.0 - 24.4.25
Vaadin 24.5.0 - 24.5.15
Vaadin 24.6.0 - 24.6.13
Vaadin 24.7.0 - 24.7.16
Vaadin 24.8.0 - 24.8.17
Vaadin 24.9.0 - 24.9.23
Vaadin 24.10.0 - 24.10.11
Vaadin 25.0.0 - 25.0.13
Vaadin 25.1.0 - 25.1.13
Vaadin 25.2.0 - 25.2.10
Vaadin 25.3.0 - 25.3.2
Vaadin Framework 7.1.0 - 7.7.54
Vaadin Framework 8.0.0 - 8.32.1
Mitigation
Upgrade to 14.14.8
Upgrade to 23.6.17
Upgrade to 24.4.26
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.9.24
Upgrade to 24.9.24
Upgrade to 24.10.12
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.3.3
Upgrade to 7.7.55
Upgrade to 8.32.2
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin / 14.14.0 - 14.14.7 / >=14.14.8
com.vaadin:vaadin / 23.6.0 - 23.6.16 / >=23.6.17
com.vaadin:vaadin / 24.4.0 - 24.4.25 / >=24.4.26
com.vaadin:vaadin / 24.5.0 - 24.5.15 / >=24.7.17
com.vaadin:vaadin / 24.6.0 - 24.6.13 / >=24.7.17
com.vaadin:vaadin / 24.7.0 - 24.7.16 / >=24.7.17
com.vaadin:vaadin / 24.8.0 - 24.8.17 / >=24.9.24
com.vaadin:vaadin / 24.9.0 - 24.9.23 / >=24.9.24
com.vaadin:vaadin / 24.10.0 - 24.10.11 / >=24.10.12
com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.11
com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.11
com.vaadin:vaadin / 25.2.0 - 25.2.10 / >=25.2.11
com.vaadin:vaadin / 25.3.0 - 25.3.2 / >=25.3.3
com.vaadin:vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8
com.vaadin:vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17
com.vaadin:vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26
com.vaadin:vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17
com.vaadin:vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17
com.vaadin:vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17
com.vaadin:vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24
com.vaadin:vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24
com.vaadin:vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12
com.vaadin:vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11
com.vaadin:vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11
com.vaadin:vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11
com.vaadin:vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3
com.vaadin:flow-server / 2.13.0 - 2.13.7 / >=2.13.8
com.vaadin:flow-server / 23.6.0 - 23.6.15 / >=23.6.16
com.vaadin:flow-server / 24.4.0 - 24.4.18 / >=24.4.19
com.vaadin:flow-server / 24.5.0 - 24.5.17 / >=24.7.17
com.vaadin:flow-server / 24.6.0 - 24.6.14 / >=24.7.17
com.vaadin:flow-server / 24.7.0 - 24.7.15 / >=24.7.16
com.vaadin:flow-server / 24.8.0 - 24.8.16 / >=24.9.24
com.vaadin:flow-server / 24.9.0 - 24.9.28 / >=24.9.29
com.vaadin:flow-server / 24.10.0 - 24.10.14 / >=24.10.15
com.vaadin:flow-server / 25.0.0 - 25.0.15 / >=25.2.11
com.vaadin:flow-server / 25.1.0 - 25.1.18 / >=25.1.19
com.vaadin:flow-server / 25.2.0 - 25.2.12 / >=25.2.13
com.vaadin:flow-server / 25.3.0 - 25.3.3 / >=25.3.4
com.vaadin:vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55
com.vaadin:vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2
com.vaadin:vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55
com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2 |
| CVE-2026-116892
|
5.3 |
2026-10-27 |
- |
- |
|
— |
— |
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin. |
| CVE-2026-116890
|
6.9 |
2026-10-27 |
- |
- |
|
— |
— |
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data. |
| CVE-2026-116891
|
5.1 |
2026-10-27 |
- |
- |
|
— |
— |
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers. |
| CVE-2026-116889
|
5.3 |
2026-10-27 |
- |
- |
|
— |
— |
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions. |
| CVE-2026-116888
|
4.8 |
2026-10-27 |
- |
- |
|
— |
— |
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators. |
| CVE-2026-116887
|
5.3 |
2026-10-27 |
- |
- |
|
— |
— |
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions. |