CVE-2026-70356

Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-72510

Toptech TMS7 and TopHAT SQL Injection

The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-63713

Toptech TMS7 and TopHAT SQL Injection

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-68954

Toptech TMS7 and TopHAT SQL Injection

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-68068

Toptech TMS7 and TopHAT SQL Injection

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-72507

Toptech TMS7 and TopHAT SQL Injection

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-71302

Toptech TMS7 and TopHAT Session Fixation

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-69662

Toptech TMS7 and TopHAT Eval Injection

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-71189

Toptech TMS7 and TopHAT Cross-site Scripting

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Toptech Systems

Products

Tms7 Tophat

CVE-2026-102771

Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Naichen Thinkcmf

Products

Thinkcmf Thinkcmf

CVE-2026-103050

Stored i18n XSS in MassMessage

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wikimedia

Products

Mediawiki - Massmessage Extension

CVE-2026-103051

Stored i18n XSSs in CentralNotice

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wikimedia

Products

Mediawiki - Centralnotice Extension

CVE-2026-103053

AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Beenuar

Products

Aisoc

CVE-2026-103054

AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Beenuar

Products

Aisoc

CVE-2026-103056

AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.

CVSS 4.0 · 9.4 Critical EPSS 1.8% KEV · Not listed

Vendors

Beenuar

Products

Aisoc

CVE-2026-103057

AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Beenuar

Products

Aisoc

CVE-2026-103087

Uncontrolled Recursion in Gosub Browser Engine Leads to Denial of Service

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit the nesting depth of processed SVG nodes, rendering such a document overflows the thread stack and terminates the application. The malicious SVG can be embedded through the SRC attribute of an IMG element, and thus exploitation only requires the victim to visit an attacker-controlled web page.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gosub-io

Products

Gosub-engine

CVE-2026-78229

OS Command Injection in PFU Image Scanner Driver for Linux

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pfu Limited

Products

Image Scanner Driver For Linux (fi Series) Image Scanner Driver For Linux (sp Series)

CVE-2026-81310

Link Following Vulnerability Allowing Arbitrary File Overwrite in PFU Image Scanner Driver for Linux

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Pfu Limited

Products

Image Scanner Driver For Linux (fi Series) Image Scanner Driver For Linux (sp Series)

CVE-2026-86556

An information disclosure vulnerability in ZTE U30 Air product

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

U30 Air