CVE-2026-61504

Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rejetto

Products

Hfs Http File Server

CVE-2026-61503

Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rejetto

Products

Hfs Http File Server

CVE-2026-61502

Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rejetto

Products

Hfs Http File Server

CVE-2026-61501

Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rejetto

Products

Hfs Http File Server

CVE-2026-61500

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

Rejetto

Products

Hfs Http File Server

CVE-2026-5917

libgit2 Shell Command Injection via ssh_libssh2 Backend

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

CVSS 4.0 · 8.6 High EPSS 1.4% KEV · Not listed

Vendors

Libgit2

Products

Libgit2

CVE-2026-58144

Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter

Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti Cotonti Siena

CVE-2026-58143

Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti Cotonti Siena

CVE-2026-57863

Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Crater-invoice-inc Craterapp

Products

Crater Crater

CVE-2026-57843

NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure

NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Netbsd

Products

Netbsd

CVE-2026-57842

NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen

NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Netbsd

Products

Netbsd

CVE-2026-56719

MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX

MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mikrotik

Products

Routeros

CVE-2026-56100

SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Bladex Springblade Project

Products

Springblade Springblade

CVE-2026-54389

Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Nationalsecurityagency Nsa

Products

Ghidra Ghidra

CVE-2026-44402

Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.

CVSS 4.0 · 9.3 Critical EPSS 1.3% KEV · Not listed

Vendors

Voltronicpower

Products

Snmp Web Pro

CVE-2026-43621

Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Simplemachines

Products

Simple Machines Forum Smf

CVE-2026-41921

Koha Stored XSS via Purchase Suggestion Handler

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Koha Koha-community

Products

Koha Koha

CVE-2026-40526

Volmarg Personal Management System Path Traversal via get-file Endpoint

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Personal-management-system Volmarg

Products

Personal Management System Personal Management System

CVE-2026-40509

OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-40508

OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr