Explore CVE records

MedPublished 22 Aug 2026, 04:21 WIB

CVE-2026-33047

Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:42 WIB

Official record

MedPublished 22 Aug 2026, 04:21 WIB

CVE-2026-53509

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresse…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

MedPublished 22 Aug 2026, 04:19 WIB

CVE-2026-53497

CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry time…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:43 WIB

Official record

MedPublished 22 Aug 2026, 04:17 WIB

CVE-2026-43980

Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:10 WIB

Official record

HighPublished 22 Aug 2026, 04:17 WIB

CVE-2026-31936

Combodo iTop: Unauthorized access to object information via search operation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:42 WIB

Official record

MedPublished 22 Aug 2026, 04:16 WIB

CVE-2026-53468

Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (`og:title` and `og:description`). An authenticated user with permission to modify page metadata can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:38 WIB

Official record

CritPublished 22 Aug 2026, 04:14 WIB

CVE-2026-49849

xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a fu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:53 WIB

Official record

HighPublished 22 Aug 2026, 04:03 WIB

CVE-2026-50538

libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:39 WIB

Official record

CritPublished 22 Aug 2026, 04:01 WIB

CVE-2026-77415

JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambda…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:55 WIB

Official record

MedPublished 22 Aug 2026, 04:00 WIB

CVE-2026-45271

picotls has infinite recursion in the minicrypto ASN.1 decoder

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS#8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the validator recur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:18 WIB

Official record

HighPublished 22 Aug 2026, 03:59 WIB

CVE-2026-31880

Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Excerpt language: en.

CVSS8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:42 WIB

Official record

HighPublished 22 Aug 2026, 03:54 WIB

CVE-2026-77220

PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

MedPublished 22 Aug 2026, 03:54 WIB

CVE-2026-69233

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 03:54 WIB

CVE-2026-69234

reflected cross site scripting vulnerability in Esri Portal for ArcGIS

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with ArcGIS Enterprise 11.1,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 03:53 WIB

CVE-2026-69235

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All user…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 03:53 WIB

CVE-2026-69236

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encourag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

LowPublished 22 Aug 2026, 03:53 WIB

CVE-2026-69237

HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS3.8v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

HighPublished 22 Aug 2026, 03:52 WIB

CVE-2026-31803

Combodo iTop: Reflected XSS in tag admin

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Excerpt language: en.

CVSS8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:42 WIB

Official record

CritPublished 22 Aug 2026, 03:51 WIB

CVE-2026-77414

JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:42 WIB

Official record

MedPublished 22 Aug 2026, 03:49 WIB

CVE-2026-69232

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage