CVE-2026-108115

Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Kortix-ai

Products

Suna

CVE-2026-107856

CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Civiform

Products

Civiform

CVE-2026-107848

Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Contao

Products

Contao

CVE-2026-105465

IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-105464

IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-103903

MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mikrotik

Products

Routeros

CVE-2026-75025

Mattermost Desktop local network access from server-rendered content

Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy. Mattermost Advisory ID: MMSA-2026-00698

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Desktop

CVE-2026-12284

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Desktop

CVE-2026-75588

Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Desktop

CVE-2026-102110

Missing authentication on a Kiteworks appliance setup function

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disrupt setup and leave the appliance in an incompletely configured state. The issue is only reachable while an appliance is being activated for the first time and not yet fully configured.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-102117

Kiteworks Core Remote Code Execution

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could then have operating-system commands executed on the node and receive their output, potentially resulting in remote code execution with the privileges of a local service account.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-102119

Kiteworks Email Protection Gateway Path Traversal

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Kiteworks Email Protection Gateway

CVE-2026-102136

Kiteworks Core Command Execution through Configuration Injection

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-102137

Kiteworks Core Unrestricted Upload of File with Dangerous Type

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-102138

Kiteworks Core Server-Side Request Forgery (SSRF)

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-102140

Kiteworks Core Insufficient Verification of Data Authenticity

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-102143

Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Kiteworks Email Protection Gateway

CVE-2026-102145

Kiteworks Core Server-Side Request Forgery through CRLF Injection

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-102146

Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Kiteworks Email Protection Gateway

CVE-2026-109152

jbardin scp.py SCP Receive _recv_pushd path traversal

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jbardin

Products

Scp.py