CVE-2026-106161

Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui Kendo Ui For Jquery

CVE-2026-106162

Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui Kendo Ui For Jquery

CVE-2026-106163

Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui Kendo Ui For Jquery

CVE-2026-106149

Cross-site Scripting (XSS) in Kendo UI for jQuery Menu

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui Kendo Ui For Jquery

CVE-2026-106151

Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui Kendo Ui For Jquery

CVE-2026-106153

Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui Kendo Ui For Jquery

CVE-2026-55453

CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openprinting

Products

Cups

CVE-2026-55467

CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Openprinting

Products

Cups

CVE-2026-55480

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Openprinting

Products

Cups

CVE-2026-77630

pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pupnp Pupnp Project

Products

Pupnp Pupnp

CVE-2026-103119

Apache Tomcat: AJP response mix-up

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation Redhat

Products

Apache Tomcat Tomcat Tomcat and 1 more

CVE-2026-111090

Improper Signature Verification of Firmware Update Files

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Stormshield

Products

Stormshield Network Security

CVE-2026-103620

Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Github

Products

Enterprise Server

CVE-2026-75996

ColdFusion | Uncontrolled Resource Consumption (CWE-400)

ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-103778

Use of Hard‑coded Cryptographic Key in Dell Command | Configure Leading to Information Disclosure

Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Command\|configure Command|configure

CVE-2026-102465

Eclipse Vert.x Redis Client OutOfMemoryError Vulnerability

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop. The impacted component is io.vertx:vertx-mysql-client.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Vert.x

CVE-2026-43841

NULL Pointer Dereference in Advantech ADAM‑3600 License Manager Service Allows Crash

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-43855

Heap-Based Buffer Overflow in Advantech ADAM-3600 Allows Arbitrary Code Execution

A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-43842

NULL Pointer Dereference in License Manager Service

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-102467

Unbounded WebSocket Decompression Allows Zip Bomb Denial of Service

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Vert.x