CVE-2026-6657

CORS Origin Validation Bypass in jupyter-server

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation against patterns intended to match `trusted.example.com`. The vulnerability affects multiple locations in the codebase, including CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.

CVSS 3.1 · 8.8 High EPSS 5.2% KEV · Not listed

Vendors

Jupyter

Products

Jupyter Server

CVE-2019-25720

Dräger SC Monitoring Devices DoS via Malformed Network Packet

Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Draeger

Products

Sc6802xl Sc8000 Sc90000 Xl and 2 more

CVE-2025-10855

IDOR in Solvera Software's Teknoera

Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trusted Identifiers. This issue affects Teknoera: through 01102025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Solvera Software

Products

Teknoera

CVE-2026-10737

SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Smartypantsplugins Wordpress

Products

Sp Project & Document Manager Wordpress

CVE-2026-8653

MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress

Products

Masterstudy Lms Wordpress

CVE-2026-41010

Command Injection via ReleaseJob Job Name in BOSH Director

ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :on_error => :return). Bosh::Common::Exec.sh executes via %x{#{command}} (bosh-common/lib/bosh/common/exec.rb:53), i.e. /bin/sh -c, so any shell metacharacters in name are interpreted. FileUtils.mkdir_p(job_dir) on line 49 creates the literal directory (no shell) and succeeds even when the name contains $()/;, so execution reaches the sh call. Affected versions: - BOSH Director: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cloud Foundry Foundation

Products

Bosh Director

CVE-2026-4881

Improper Permission Checks Allow Server‑Level Configuration Changes via API

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Octopus

Products

Octopus Server

CVE-2026-49771

WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

10web Wordpress

Products

Photo Gallery Wordpress

CVE-2026-49077

WordPress WP eMember plugin <= v10.2.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember: from n/a through v10.2.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tipsandtricks-hq Wordpress

Products

Wp Emember Wordpress

CVE-2026-40930

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pnggroup

Products

Libpng

CVE-2026-48480

netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Netty

Products

Netty-incubator-codec-ohttp

CVE-2025-10856

Arbitrary File Upload in Solvera Software's Teknoera

Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Solvera Software

Products

Teknoera

CVE-2025-10876

XSS in Talent Software's e-Bap

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Cross-Site Scripting (XSS). This issue affects e-BAP Automation: from 1.8.96 before v.41815.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Talentsoftware

Products

Bap Automation

CVE-2025-10912

IDOR in saastech.io's TemizlikYolda

Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Manipulating User-Controlled Variables. This issue affects TemizlikYolda: through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Saastech Cleaning And Internet Services Inc.

Products

Temizlikyolda

CVE-2025-10913

XSS in saastech.io's TemizlikYolda

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Cross-Site Scripting (XSS). This issue affects TemizlikYolda: through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Saastech Cleaning And Internet Services Inc.

Products

Temizlikyolda

CVE-2025-10914

Reflected XSS in Proliz's OBS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Reflected XSS. This issue affects OBS (Student Affairs Information System): before V26.0401.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Proliz Software

Products

Obs

CVE-2025-10955

HTML Injection in Netcad Software's Netigma

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows XSS Through HTTP Query Strings. This issue affects Netigma: from 6.3.5 before 6.3.5 V8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Netcad

Products

Netigma

CVE-2025-10968

SQLi in GG Soft's PaperWork

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection. This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gg Soft

Products

Paperwork

CVE-2025-10969

SQLi in Farktor Software's E-Commerce Package

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Blind SQL Injection. This issue affects E-Commerce Package: through 27112025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Farktor Farktor Software E-commerce Services Inc.

Products

E-commerce Package E-commerce Package

CVE-2025-10970

SQLi in Kolay Software's Talentics

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection. This issue affects Talentics: through 20022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Kolay Software Inc.

Products

Talentics