CVE-2026-67281

Unauthenticated file read in Mikrotik RouterOS

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mikrotik

Products

Routeros

CVE-2026-96515

Command Injection Vulnerability in Netlink ICT HG323RW Router

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the web management interface. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary operating system commands with root privileges resulting in complete compromise of the affected device.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Netlink Ict Netlink Ict Pvt Ltd

Products

Hg323rw Router Netlink Ict Hg323rw Router

CVE-2026-88907

SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Tübi̇tak Ulakbi̇m

Products

Ulakpdf

CVE-2026-88916

Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tübi̇tak Ulakbi̇m

Products

Ulakpdf

CVE-2026-12559

Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Opentext

Products

Vendor Invoice Management For Sap Solutions

CVE-2026-77703

SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman Render Engine: from 1.0 before 1.2-75.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Havelsan

Products

Liman Render Engine

CVE-2026-77707

TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render Engine

Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman Render Engine: from 1.0 before 1.2-75.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Havelsan

Products

Liman Render Engine

CVE-2026-97865

Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Open-web-analytics

Products

Open-web-analytics

CVE-2026-97864

GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 31.0.00 is sufficient to fix this issue. The identifier of the patch is 07e719368eae8dfb4e22e19424ceab6074164ebc. It is recommended to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gibbonedu

Products

Gibbon

CVE-2026-97863

misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character (e.g., a crafted ip-dst or url attribute value submitted to MISP) breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who subsequently executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key. The vulnerability requires the attacker to have the ability to submit MISP events or attributes containing a single-quote character and the victim to execute the exported script. No authentication bypass is required beyond standard MISP event-submission privileges.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp-modules

CVE-2026-97818

phpIPAM User API Authorization Bypass for Admins and All Users IDs

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Phpipam

Products

Phpipam

CVE-2026-97764

Login Attempt Limit Bypass via Diacritic Handling

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Allauth

Products

Django-allauth

CVE-2026-97735

SVG Attachment Vulnerability in ITFlow Ticket Email Parser

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Itflow

Products

Itflow

CVE-2026-97732

Unprivileged Certificate Bypass in IRONMACE Ironshield tvk.sys Driver

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ironmace

Products

Ironshield

CVE-2026-97724

Prototype Pollution Leading to Remote Denial of Service via React Native Worklets

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Swmansion

Products

React Native Reanimated

CVE-2026-97723

Stored XSS in ka9q_ubersdr chat message rendering

madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated href attribute and introduce attacker-controlled HTML attributes, allowing arbitrary JavaScript to execute in the browser of another user when the stored chat message was rendered. No click on the malicious link was required.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Madpsy

Products

Ka9q Ubersdr

CVE-2026-97650

ningzichun student-management-system addLog.php echo cross site scripting

A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ningzichun

Products

Student-management-system

CVE-2026-97368

chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Chillzhuang

Products

Springblade

CVE-2025-32000

Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hcl Sametime

CVE-2026-95864

Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Themify Wordpress-extensions

Products

Themify Builder Themify Builder