CVE-2026-22896

Stored XSS via Interface Name in Network & Virtual Switch App

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Systems

Products

Network & Virtual Switch

CVE-2023-32198

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Steve

CVE-2026-93649

Adoptium Website Vulnerable to Redirection-based Download of Malicious Binary

In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Adoptium Temurin

CVE-2026-110746

CVE-2026-110746

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Totalsecurity

Products

Totalav

CVE-2026-79839

HPE NonStop ODBC/MX Server - Memory corruption vulnerability

A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Odbc/mx Server

CVE-2026-79841

HPE NonStop RDMA SERVICES NSK - Out-of-bounds memory write vulnerability

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Rdma Services Nsk

CVE-2026-45449

Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Unitronics

Products

Unistream Unilogic

CVE-2026-45450

Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Unitronics

Products

Unistream Unilogic

CVE-2026-45451

Unitronics - CWE-287: Improper Authentication

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Unitronics

Products

Unistream Unilogic

CVE-2026-45452

Unitronics - CWE-134 Use of Externally-Controlled format string

Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Unitronics

Products

Unistream Unilogic

CVE-2026-55246

bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Tatsh

Products

Bincookie

CVE-2026-63430

ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia does not correctly implement annotation-xml's encoding-dependent MathML integration-point behavior after attribute filtering removes encoding, so the sanitizer validates a descendant under one namespace interpretation while the browser reparses the output under another. An attacker can use that namespace transition and an allowed raw-text HTML element to execute JavaScript when a user renders the sanitized output. The required tags are not enabled by default, so applications that do not explicitly allow them are not affected. This issue is fixed in versions 3.3.2, 4.0.2, and 4.1.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rust-ammonia

Products

Ammonia

CVE-2026-98791

net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences it. Return zero when no CQE is available, indicating that teardown did not produce a TX timestamp.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-111625

10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

10up

Products

Distributor

CVE-2026-98624

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close() which can call the release function while unrelated socket processes UNBIND request for same portid: Oops: general protection fault, [..] RIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue] Call Trace: nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue] nfnetlink_rcv_msg+0x7c2/0xeb0 ? __pfx_nfnetlink_rcv_msg+0x10/0x10 After this, parallel UNBIND and URELEASE events are impossible. This change isn't nice, but its the shortest fix given instances are not refcounted and the nfnetlink config callback drops the rcu read lock early due to need for sleeping allocations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-47218

runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Containerd

Products

Runwasi

CVE-2026-111131

libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Libxmp

Products

Libxmp

CVE-2026-111133

libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data

libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libfsapfs

CVE-2026-111136

libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Swami

Products

Libinstpatch

CVE-2026-111137

libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL

libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Amartin755

Products

Libsmi