CVE-2026-104471

YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104463

YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104459

YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104455

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104451

YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104447

YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104443

YesWiki before 4.6.7 Scope Bypass via Triples Delete API

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104439

YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104429

Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zcashfoundation Zfnd

Products

Zebra Zebra

CVE-2026-81480

Stack Buffer Overflow in Dell OpenManage Server Administrator

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Dell Openmanage Server Administrator Managed Node For Rhel 8.10 Dell Openmanage Server Administrator Managed Node For Rhel 9.4 Dell Openmanage Server Administrator Managed Node For Sles 15 and 3 more

CVE-2026-81481

Improper Pathname Restriction Enables Remote File System Access in Dell OpenManage Server Administrator

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Dell Openmanage Server Administrator Managed Node For Rhel 8.10 Dell Openmanage Server Administrator Managed Node For Rhel 9.4 Dell Openmanage Server Administrator Managed Node For Sles 15 and 3 more

CVE-2026-104456

YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104466

YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104452

YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-93985

OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-93984

OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-93983

OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-93982

OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-56392

Heap-based Buffer Overflow in GNU coreutils

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write. When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout. This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Coreutils

CVE-2026-84414

IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I