CVE-2026-101356

Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation Redhat

Products

Apache Tomcat Tomcat Tomcat and 1 more

CVE-2026-71253

Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Johnzon

CVE-2026-112248

grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Grandnode

Products

Grandnode Grandnode2

CVE-2026-112252

Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wuxi Wubang Security Software

Products

Five-in-one Safety Production Management Information System Wubang Five-in-one Safety Production Management Information System

CVE-2026-113810

Stored XSS on SNS Enrollment Portal

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Stormshield

Products

Stormshield Network Security

CVE-2026-107806

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

0xjacky Nginxui

Products

Nginx-ui Nginx Ui

CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-109680

FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername that reaches the CLI credential prompt, crashing the client when the user types input.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-112148

DOM-based XSS in LIFF SDK triggered by crafted URLs enabling arbitrary JavaScript execution

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ly Corporation

Products

Liff Sdk

CVE-2026-93878

DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes when an administrator visits the DiviGear > Activation settings page, where the unsanitized stored value is echoed unescaped into a single-quoted HTML value attribute.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Divigear Wordpress-extensions

Products

Divigear Carousel Divigear Carousel

CVE-2026-113403

ArmorX Global Technology｜ArmorX Spam - Command Injection

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Armorx Global Technology

Products

Armorx Spam

CVE-2026-113407

YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ys-infoware

Products

Ba-workflow

CVE-2026-85267

Cross-Site WebSocket Hijacking in Google Cloud Shell

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Google Cloud

Products

Cloud Shell

CVE-2026-112238

SQL Injection in extension "File manager" (ameos_filemanager)

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension File Manager

CVE-2026-111844

WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Brizy Wordpress-extensions

Products

Brizy Brizy

CVE-2026-108062

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Eclipse Pia

CVE-2026-107597

jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Eclipse Pia

CVE-2026-108089

Apache Cocoon: Unauthenticated access to diagnostic interfaces

** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Cocoon

CVE-2026-113351

libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Libexpat Project

Products

Libexpat

CVE-2026-113352

uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Utox

Products

Utox