CVE-2026-79825

HPE NonStop NDSREST - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ndsrest

CVE-2026-39989

SSRF in QNAP Download Station

A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Download Station

CVE-2026-39991

Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Notes Station

CVE-2026-39997

Unauthenticated Remote Input Injection in QNAP HD Station's remotepad

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Hybriddesk Station

CVE-2026-79826

HPE NonStop OCAX - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ocax

CVE-2026-79840

HPE NonStop XABroker - Memory corruption vulnerability

A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Xabroker

CVE-2026-79843

HPE NonStop SQL/MX EXE - out-of-bounds read vulnerability

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Sql/mx Exe

CVE-2026-110899

WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kevin Stover Wordpress-extensions

Products

Ninja Forms Ninja Forms

CVE-2026-16477

Insecure Deserialization of .cleanshot Files in CleanShot X

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Mtw

Products

Cleanshot X

CVE-2026-55644

Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin

Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Element-hq

Products

Element-x-ios

CVE-2026-4629

Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak

CVE-2026-4628

Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform and 5 more

CVE-2026-37980

Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak

CVE-2026-11319

TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity

TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ticktick Limited

Products

Ticktick For Android

CVE-2026-112780

Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-112775

Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Craft Cms

CVE-2026-112770

Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-112302

kiwilan php-archive Extraction ArchiveZip.php extract path traversal

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kiwilan

Products

Php-archive

CVE-2026-112297

ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ptbsare

Products

Anx-calibre-manager

CVE-2026-112249

grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Grandnode

Products

Grandnode2