CVE-2026-107781

Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Skyeye

CVE-2026-100833

Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a Kubernetes cluster administrator in Contrast's threat model — can therefore substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, undermining the confidential container's integrity guarantees.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Edgelesssys

Products

Contrast

CVE-2026-107700

dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ntharim

Products

Dot-access

CVE-2026-104076

TVU Networks Receiver/Transceiver Missing Authentication via REST API

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tvu Networks

Products

Tvu Receiver / Transceiver

CVE-2026-91140

OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

CVSS 3.1 · 9.6 Critical EPSS 2.0% KEV · Not listed

Vendors

Progress Software

Products

Autonomous Rest Connector Genai Agents

CVE-2026-105794

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

CVSS 4.0 · 9.1 Critical EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Msquic

CVE-2026-105844

Payload: Prototype pollution in Payload Import Export plugin

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload Plugin-import-export

CVE-2026-104070

SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Spip

Products

Spip Crayons Plugin

CVE-2026-106511

CVE-2026-106511

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Multiversx Labs

Products

Multisig-improved

CVE-2026-76742

Authentication Bypass in the Web Management Interface of AOS-S

Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76743

Authentication Bypass Vulnerability in the Management Interface of AOS-S

A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76744

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S

Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76745

Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S

Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76746

Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S

An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-76747

Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S

Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Aos-switch

CVE-2026-102159

Security Advisory 0190

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Cue

CVE-2026-101157

Security Advisory 0192

A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Cue

CVE-2026-102162

Security Advisory 0193

On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Wi-fi Access Points

CVE-2026-102167

Security Advisory 0197

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Wi-fi Access Points

CVE-2025-70516

WebSocket Authentication Bypass in Fanvil X7A Firmware 2.6.0.1182

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Fanvil

Products

X7a