CVE-2026-92193

Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability

Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-29216.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Quest

Products

Foglight For Databases

CVE-2026-92188

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168.

CVSS 3.0 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Quest

Products

Foglight For Databases

CVE-2026-92192

Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the installLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29215.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Quest

Products

Foglight For Databases

CVE-2026-92195

Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadEvolveLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29232.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Quest

Products

Foglight For Databases

CVE-2026-92194

Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadManageServerLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29231.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Quest

Products

Foglight For Databases

CVE-2026-92186

Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the paFnUploadFileAndCreateInfo script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29038.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Quest

Products

Foglight For Databases

CVE-2026-112340

Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request

Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wazuh

Products

Wazuh Wazuh-dashboard

CVE-2026-76826

tsParticles: Generated release notes can execute shell commands in the stable publish workflow

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tsparticles

Products

Tsparticles

CVE-2026-76893

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tsparticles

Products

Mcp-server Tsparticles

CVE-2026-76892

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated malformed JSON body raises a SyntaxError that terminates the Node.js process, leaving the MCP service unavailable until an external supervisor restarts it. This issue is fixed in version 4.3.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tsparticles

Products

Mcp-server Tsparticles

CVE-2026-63655

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer[] without a cumulative size limit before Buffer.concat and JSON.parse. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory and terminate the service, including in the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000. Confidentiality and integrity are not affected. This issue is fixed in version 4.3.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tsparticles

Products

Mcp-server Tsparticles

CVE-2026-35106

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35109

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35115

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcl Hcltech

Products

Aion Aion

CVE-2026-35114

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35113

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35112

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35111

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35110

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35105

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion