CVE-2026-59192

TwigView: Deserialization of Untrusted Data

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-64686

OpenSearch Dashboards: SSRF in fetchDataSourceMetaData — missing endpoint validation

OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling test_connection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-64678

Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path

NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-64682

AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name

AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116645

LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Limesurvey

Products

Limesurvey Community Edition

CVE-2026-63660

node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF

node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126571

Padloc 4.0.0 before 4.3.1 Email MFA Code Brute Force via retrieveMFAToken

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification tokens usable in signup, login and account recovery flows.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126570

Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126569

Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link

Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126567

Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output

Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126566

Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations

Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit and move protection logged under the administrator's name.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126565

Semantic MediaWiki 3.0.0 before 7.4.1 DoS via Exponential Concept Expansion

Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages that fan out, so queries via concept page views, Special:Ask, or api.php action=ask exhaust CPU and memory.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126564

Semantic MediaWiki 2.5.0 before 7.4.1 Stored XSS via Special:Browse Factbox Title

Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal &nbsp; as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126563

Semantic MediaWiki 2.4.0 before 7.4.1 Reflected XSS via Special:Ask Date Format

Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126562

Semantic MediaWiki 3.0.0 before 7.4.1 Uncontrolled Recursion via ElasticStore ConceptDescriptionInterpreter

Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views, Special:Ask, or api.php action=ask queries to exhaust PHP memory or stack.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126561

Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation

Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126560

Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via data-search Attributes

Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-126559

Semantic MediaWiki 4.2.0 before 7.4.1 Stored XSS via Special:FacetedSearch

Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-63194

Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-63192

Bahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—